---
id: CVE-2026-99044
title: 'ice: fix use-after-free in dynamic port cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ice: fix use-after-free in dynamic port cleanup

  ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
  port from pf->dyn_ports. However, it frees the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 <
    7c1344df1ae0579f57b97647e5203b06496ce10c
  - >-
    Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 <
    ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1
  - >-
    Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 <
    b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84
  - >-
    Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 <
    1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff
  - Linux 6.12
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:22:08.328Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99044'
references:
  - url: 'https://git.kernel.org/stable/c/7c1344df1ae0579f57b97647e5203b06496ce10c'
  - url: 'https://git.kernel.org/stable/c/ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1'
  - url: 'https://git.kernel.org/stable/c/b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84'
  - url: 'https://git.kernel.org/stable/c/1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.526Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ice: fix use-after-free in dynamic port cleanup

ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
port from pf->dyn_ports. However, it frees the VSI before reading the
index for the erase, resulting in a use-after-free.

Follow the reverse of the allocation order in ice_alloc_dynamic_port()
by erasing the xarray entry before freeing the VSI.

## Affected

- `Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 < 7c1344df1ae0579f57b97647e5203b06496ce10c`
- `Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 < ca8a6285b11d01e5a279b1aa7fb55b1a02ecebb1`
- `Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 < b98eb58ba2f8fe8e9bba1b8a3b94fa5602c6de84`
- `Linux >= eda69d654c7edae21312f731e0308941cb2ee2a9 < 1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.