CVE-2026-72425

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72425", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.928Z", "datePublished": "2026-08-15T05:56:42.959Z", "dateUpdated": "2026-10-16T18:55:23.412Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:05.008Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()\n\nResetting all VFs causes resource leak on VFs with FDIR filters\nenabled as CTRL VSIs are only invalidated and not freed. Fix by using\nice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which\naligns behavior with the ice_reset_vf() function.\n\nReproduction:\n echo 1 > /sys/class/net/$pf/device/sriov_numvfs\n ethtool -N $vf flow-type ether proto 0x9000 action 0\n echo 1 > /sys/class/net/$pf/device/reset"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via local host interfaces only: VF virtchnl mailbox messages (VIRTCHNL_OP_ADD_FDIR_FILTER) to create per-VF FDIR ctrl VSIs, and PF-wide reset paths (PCI sysfs reset, ethtool-driven PFR/CORER/GLOBR) that call ice_reset_all_vfs(); no network packet receive path is involved.\nAC:L - Once a VF has created an FDIR rule (which allocates the per-VF ctrl VSI), each PF-wide reset deterministically leaks that ctrl VSI because ice_reset_all_vfs() only invalidated ctrl_vsi_idx instead of calling ice_vf_ctrl_vsi_release(); the commit reproduces this reliably and the attacker controls the FDIR setup side of the race.\nPR:N - No host root or CAP_SYS_ADMIN is required on the vulnerable host: a tenant with an assigned SR-IOV VF can negotiate VIRTCHNL_VF_OFFLOAD_FDIR_PF and send VIRTCHNL_OP_ADD_FDIR_FILTER over the VF mailbox to create the ctrl VSI; PF-wide resets occur during normal firmware/PCI/driver recovery without further host credentials.\nUI:N - Exploitation does not require any victim user action such as opening files or clicking links; a malicious VM tenant programs FDIR filters via the standard iAVF virtchnl interface and the leak triggers automatically on subsequent PF-wide reset events.\nS:C - The vulnerable ice driver runs in the host kernel but is triggered from an SR-IOV VF guest security domain; leaked ctrl VSIs consume finite pf->vsi slots and hardware VSI resources on the host, degrading or denying NIC functionality for the hypervisor and other VMs on the same PF.\nC:N - This is a kernel resource leak (orphaned ICE_VSI_CTRL structures and associated queue/MSI-X/FDIR hardware resources) without out-of-bounds read, use-after-free, or other memory disclosure primitive; no confidential data is exposed.\nI:N - The flaw only fails to call ice_vsi_release()/ice_vsi_delete_from_hw() for per-VF ctrl VSIs during ice_reset_all_vfs(); it does not corrupt memory, modify data, or provide write or code-execution primitives.\nA:H - Each leaked ctrl VSI permanently consumes a limited VSI slot (pf->num_alloc_vsi) and hardware resources; repeated PF-wide resets with FDIR-enabled VFs can exhaust the VSI pool causing ice_vsi_alloc() failure and denial of network service for the host and all co-resident VFs on the NIC."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "versions": [{"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "b409a9dc37db8bd798122fc5bcdcfaccaf80db1e", "status": "affected", "versionType": "git"}, {"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "335c2dd21ad9d520102906f96edb99fd5e89ac32", "status": "affected", "versionType": "git"}, {"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "87a042e45bf4870dc75ea05b4fc0286abecb2a4d", "status": "affected", "versionType": "git"}, {"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "dd6d8e4412f805937f61f00bbfdfe831978be235", "status": "affected", "versionType": "git"}, {"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "b1fc5bafbc5f84df457b6f987ac993e0802f8d93", "status": "affected", "versionType": "git"}, {"version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "ebbe8868cf473f698e0fbaf436d2618b2bcda806", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b409a9dc37db8bd798122fc5bcdcfaccaf80db1e"}, {"url": "https://git.kernel.org/stable/c/335c2dd21ad9d520102906f96edb99fd5e89ac32"}, {"url": "https://git.kernel.org/stable/c/87a042e45bf4870dc75ea05b4fc0286abecb2a4d"}, {"url": "https://git.kernel.org/stable/c/dd6d8e4412f805937f61f00bbfdfe831978be235"}, {"url": "https://git.kernel.org/stable/c/b1fc5bafbc5f84df457b6f987ac993e0802f8d93"}, {"url": "https://git.kernel.org/stable/c/ebbe8868cf473f698e0fbaf436d2618b2bcda806"}], "title": "ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:49:44.051789Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:23.412Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:49:44.051789Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:49:44.583Z"}}], "cna": {"title": "ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via local host interfaces only: VF virtchnl mailbox messages (VIRTCHNL_OP_ADD_FDIR_FILTER) to create per-VF FDIR ctrl VSIs, and PF-wide reset paths (PCI sysfs reset, ethtool-driven PFR/CORER/GLOBR) that call ice_reset_all_vfs(); no network packet receive path is involved.\nAC:L - Once a VF has created an FDIR rule (which allocates the per-VF ctrl VSI), each PF-wide reset deterministically leaks that ctrl VSI because ice_reset_all_vfs() only invalidated ctrl_vsi_idx instead of calling ice_vf_ctrl_vsi_release(); the commit reproduces this reliably and the attacker controls the FDIR setup side of the race.\nPR:N - No host root or CAP_SYS_ADMIN is required on the vulnerable host: a tenant with an assigned SR-IOV VF can negotiate VIRTCHNL_VF_OFFLOAD_FDIR_PF and send VIRTCHNL_OP_ADD_FDIR_FILTER over the VF mailbox to create the ctrl VSI; PF-wide resets occur during normal firmware/PCI/driver recovery without further host credentials.\nUI:N - Exploitation does not require any victim user action such as opening files or clicking links; a malicious VM tenant programs FDIR filters via the standard iAVF virtchnl interface and the leak triggers automatically on subsequent PF-wide reset events.\nS:C - The vulnerable ice driver runs in the host kernel but is triggered from an SR-IOV VF guest security domain; leaked ctrl VSIs consume finite pf->vsi slots and hardware VSI resources on the host, degrading or denying NIC functionality for the hypervisor and other VMs on the same PF.\nC:N - This is a kernel resource leak (orphaned ICE_VSI_CTRL structures and associated queue/MSI-X/FDIR hardware resources) without out-of-bounds read, use-after-free, or other memory disclosure primitive; no confidential data is exposed.\nI:N - The flaw only fails to call ice_vsi_release()/ice_vsi_delete_from_hw() for per-VF ctrl VSIs during ice_reset_all_vfs(); it does not corrupt memory, modify data, or provide write or code-execution primitives.\nA:H - Each leaked ctrl VSI permanently consumes a limited VSI slot (pf->num_alloc_vsi) and hardware resources; repeated PF-wide resets with FDIR-enabled VFs can exhaust the VSI pool causing ice_vsi_alloc() failure and denial of network service for the host and all co-resident VFs on the NIC."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "b409a9dc37db8bd798122fc5bcdcfaccaf80db1e", "versionType": "git"}, {"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "335c2dd21ad9d520102906f96edb99fd5e89ac32", "versionType": "git"}, {"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "87a042e45bf4870dc75ea05b4fc0286abecb2a4d", "versionType": "git"}, {"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "dd6d8e4412f805937f61f00bbfdfe831978be235", "versionType": "git"}, {"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "b1fc5bafbc5f84df457b6f987ac993e0802f8d93", "versionType": "git"}, {"status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "lessThan": "ebbe8868cf473f698e0fbaf436d2618b2bcda806", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b409a9dc37db8bd798122fc5bcdcfaccaf80db1e"}, {"url": "https://git.kernel.org/stable/c/335c2dd21ad9d520102906f96edb99fd5e89ac32"}, {"url": "https://git.kernel.org/stable/c/87a042e45bf4870dc75ea05b4fc0286abecb2a4d"}, {"url": "https://git.kernel.org/stable/c/dd6d8e4412f805937f61f00bbfdfe831978be235"}, {"url": "https://git.kernel.org/stable/c/b1fc5bafbc5f84df457b6f987ac993e0802f8d93"}, {"url": "https://git.kernel.org/stable/c/ebbe8868cf473f698e0fbaf436d2618b2bcda806"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()\n\nResetting all VFs causes resource leak on VFs with FDIR filters\nenabled as CTRL VSIs are only invalidated and not freed. Fix by using\nice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which\naligns behavior with the ice_reset_vf() function.\n\nReproduction:\n echo 1 > /sys/class/net/$pf/device/sriov_numvfs\n ethtool -N $vf flow-type ether proto 0x9000 action 0\n echo 1 > /sys/class/net/$pf/device/reset"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:44:05.008Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72425", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:23.412Z", "dateReserved": "2026-08-09T03:40:39.928Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:56:42.959Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b409a9dc37db8bd798122fc5bcdcfaccaf80db1e", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}, {"lessThan": "335c2dd21ad9d520102906f96edb99fd5e89ac32", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}, {"lessThan": "87a042e45bf4870dc75ea05b4fc0286abecb2a4d", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}, {"lessThan": "dd6d8e4412f805937f61f00bbfdfe831978be235", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}, {"lessThan": "b1fc5bafbc5f84df457b6f987ac993e0802f8d93", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}, {"lessThan": "ebbe8868cf473f698e0fbaf436d2618b2bcda806", "status": "affected", "version": "da62c5ff9dcdac67204d6647f3cd43ad931a59f4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ice/ice_vf_lib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()\n\nResetting all VFs causes resource leak on VFs with FDIR filters\nenabled as CTRL VSIs are only invalidated and not freed. Fix by using\nice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which\naligns behavior with the ice_reset_vf() function.\n\nReproduction:\n echo 1 > /sys/class/net/$pf/device/sriov_numvfs\n ethtool -N $vf flow-type ether proto 0x9000 action 0\n echo 1 > /sys/class/net/$pf/device/reset"}], "id": "CVE-2026-72425", "lastModified": "2026-10-16T19:17:29.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72425", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:49:44.051789Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:16.317", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/335c2dd21ad9d520102906f96edb99fd5e89ac32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87a042e45bf4870dc75ea05b4fc0286abecb2a4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1fc5bafbc5f84df457b6f987ac993e0802f8d93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b409a9dc37db8bd798122fc5bcdcfaccaf80db1e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd6d8e4412f805937f61f00bbfdfe831978be235"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebbe8868cf473f698e0fbaf436d2618b2bcda806"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()", "id": "2516616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516616"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()\nResetting all VFs causes resource leak on VFs with FDIR filters\nenabled as CTRL VSIs are only invalidated and not freed. Fix by using\nice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which\naligns behavior with the ice_reset_vf() function.\nReproduction:\necho 1 > /sys/class/net/$pf/device/sriov_numvfs\nethtool -N $vf flow-type ether proto 0x9000 action 0\necho 1 > /sys/class/net/$pf/device/reset", "A flaw was found in the Linux kernel's ice driver. A local user could trigger a resource leak by resetting all Virtual Functions (VFs) while FDIR (Flow Director) filters are enabled. This occurs because control VSIs (Virtual Station Interfaces) are invalidated but not properly freed, leading to a gradual consumption of system resources. This resource exhaustion can ultimately result in a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-72425", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72425\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72425\nhttps://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72425-6d2c@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,b409a9dc37db8bd798122fc5bcdcfaccaf80db1e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,335c2dd21ad9d520102906f96edb99fd5e89ac32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,87a042e45bf4870dc75ea05b4fc0286abecb2a4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,dd6d8e4412f805937f61f00bbfdfe831978be235)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,b1fc5bafbc5f84df457b6f987ac993e0802f8d93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da62c5ff9dcdac67204d6647f3cd43ad931a59f4,ebbe8868cf473f698e0fbaf436d2618b2bcda806)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:15:03.781647+00:00", "updated": "2026-08-22T03:30:16.806213+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401", "CWE-772"]}