---
id: CVE-2026-46162
title: 'ice: fix double free in ice_sf_eth_activate() error path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ice: fix double free in ice_sf_eth_activate() error path

  When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to
  aux_dev_uninit and calls auxiliary_device_un…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 <
    2ca30340b5028ddc3f17086a538feeff06167b1b
  - >-
    Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 <
    121d1f253aed515cd85748f68c664a6cb756e8ad
  - >-
    Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 <
    d0c6a4816609f145ffcc74e64baa214c571c17c6
  - >-
    Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 <
    9aab1c3d7299285e2569cbc0ed5892d631a241b2
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:10:40.396215Z'
published: '2026-05-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:42.354Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46162'
references:
  - url: 'https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b'
  - url: 'https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad'
  - url: 'https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6'
  - url: 'https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2'
tags:
  - cve.org
epss: 0.00138
epssPercentile: 0.0321
ingestedAt: '2026-11-06T16:57:43.328Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: fix double free in ice_sf_eth_activate() error path

When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to
aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev).

The device release callback ice_sf_dev_release() frees sf_dev, but
the current error path falls through to sf_dev_free and calls
kfree(sf_dev) again, causing a double free.

Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but
avoid falling through to sf_dev_free after auxiliary_device_uninit().

## Affected

- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 2ca30340b5028ddc3f17086a538feeff06167b1b`
- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 121d1f253aed515cd85748f68c664a6cb756e8ad`
- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < d0c6a4816609f145ffcc74e64baa214c571c17c6`
- `Linux >= 13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6 < 9aab1c3d7299285e2569cbc0ed5892d631a241b2`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.