What is the CVSS score of CVE-2026-53009?

CVE-2026-53009 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-53009?

Within 24 hours: Identify all Linux systems using the Intel ice network driver (verify via 'lspci | grep -i ice' and ethtool driver confirmation). Within 7 days: Apply the kernel security update from your Linux distribution addressing CVE-2026-53009 in the ice driver (consult your vendor-RHEL, Ubuntu, SLES, etc.-for the specific patched kernel version). Within 30 days: Confirm patch deployment across all affected systems; implement local account access controls on any systems with delayed remediation.

Linux Kernel CVE-2026-53009

EUVD-2026-38877 HIGH

Multiple Releases of Same Resource or Handle (CWE-1341)

2026-06-24 Linux

GHSA-67p5-53x6-9j7q

Linux Code Injection Intel

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local access to host with ice NIC
Delivery

Force TSO/checksum offload failure on TX
Exploit

skb freed but tx_buf left valid
Execution

Bring ice interface down
Persist

ice_clean_tx_ring double-frees skb
Impact

Kernel heap corruption / crash

Vulnerability Assessment

Weakness	CWE CWE-1341
Exploitation Conditions	Exploitation requires that an Intel E800-series NIC using the ice driver is present and active, and that ice_tso() or ice_tx_csum() fails in ice_xmit_frame_ring() (an uncommon TX offload error path), leaving the freed skb's tx_buf still marked ICE_TX_BUF_SKB. The second free only occurs if no subsequent packet is transmitted on that descriptor (which would harmlessly overwrite it) and the interface is then brought down, invoking ice_clean_tx_ring()->ice_unmap_and_free_tx_buf(). Limiting factors: local access only (AV:L), the bug typically self-heals under normal traffic, the failure path is hard to reach without fault injection, and interface teardown generally needs network-admin privilege - so despite PR:L in the CVSS, practical triggering is constrained and most plausibly yields a crash rather than controlled compromise.
Impact	Signals point to a genuine but low-priority bug for most environments. The CVSS vector is AV:L/AC:L/PR:L/UI:N with C:H/I:H/A:H giving 7.8, the standard high score automatically assigned to kernel memory-safety issues, but the real-world preconditions are far narrower than AC:L suggests: the attacker must force ice_tso()/ice_tx_csum() to fail (an uncommon offload error path) AND have the ice interface brought down before the next packet rewrites the descriptor. EPSS is 0.15% (5th percentile) and the CVE is not in CISA KEV, consistent with no observed exploitation. There is no public PoC; the only working trigger described is the reporter's own fault-injection harness under KASAN. The most realistic impact is a denial of service (kernel crash) on systems using Intel E810 NICs; turning a double-free into privilege escalation or code execution is theoretically possible but unproven here. Note a tension worth verifying: CVSS assigns PR:L, yet triggering reliably depends on interface teardown which normally requires CAP_NET_ADMIN, suggesting effective privilege is higher than PR:L implies.
Exploit ScenarioDerived	A local user or workload capable of driving the TX path and influencing interface state induces an offload failure (e.g. via crafted TSO/checksum conditions) so the skb is freed once, then causes or waits for the ice interface to be brought down, triggering ice_clean_tx_ring() to free the same skb again and corrupt kernel heap state, typically crashing the host. No public PoC exists; the only demonstrated reproduction used deliberate fault injection on a KASAN build, and converting the double-free into reliable privilege escalation would require significant additional exploitation work.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege-impacting memory corruption in the Linux kernel's Intel ice network driver allows a double-free of a transmit buffer's skb when the TX offload paths fail. When ice_tso() or ice_tx_csum() return an error, ice_xmit_frame_ring() frees the skb but leaves the 'first' tx_buf still marked ICE_TX_BUF_SKB, so a later ice_clean_tx_ring() during interface teardown frees the same skb a second time. Carries a CVSS 3.1 base of 7.8 (AV:L/PR:L), but with a low EPSS of 0.15% (5th percentile), no KEV listing, and no public exploit identified at time of analysis.

RemediationAI

Apply the upstream kernel fix, which resets the tx_buf type to ICE_TX_BUF_EMPTY in the TX error path and moves initialization of 'first' earlier so it is valid on the linearization error path; the fix is delivered via the stable-tree commits https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2 and https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd. Patch status: upstream fix available as stable commits; consume it through your distribution's patched kernel package rather than an independently confirmed tagged release. Because the affected code is core TX handling within the ice driver and not gated by a toggle, there is no clean feature-level workaround; the only meaningful compensating control is to avoid loading/using the ice driver on non-essential hosts (e.g. blacklist the module where the Intel E810 NIC is unused), which obviously disables those interfaces and is impractical where the NIC is the primary uplink. Until patched, limit who can administratively bring interfaces down (restrict CAP_NET_ADMIN) to reduce the chance of triggering the second free.

Affected VersionsENISA

Linux d76a60ba7afb89523c88cf2ed3a044ce4180289e <4c08fc2119ef0281cfa2cee007acf0a251be55f2

Linux patch: 7.0.10

Linux patch: 7.1

Linux 4.17

Linux d76a60ba7afb89523c88cf2ed3a044ce4180289e <1a303baa715e6b78d6a406aaf335f87ff35acfcd

Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw lives in the Intel 'ice' Ethernet driver (drivers/net/ethernet/intel/ice) that supports Intel E800-series (E810) adapters. The TX hot path stages an outgoing packet in a tx_buf descriptor where the 'first' buffer records the owning skb and a type tag (ICE_TX_BUF_SKB) marking it as holding a freeable socket buffer. The root cause is a classic double-free / use-after-free (CWE-415/CWE-416, though the feed lists CWE as N/A): the error path frees the skb but never resets the tx_buf type to ICE_TX_BUF_EMPTY, leaving a dangling owning reference. Because next_to_use is not advanced, normal traffic usually overwrites the stale descriptor and masks the bug, but ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() invoked during interface bring-down will free the already-freed skb again. The 'Code Injection' tag and high integrity/confidentiality impact reflect the general exploitation potential of kernel heap double-frees rather than a demonstrated code-execution primitive.

Know when Intel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 4.1 MEDIUM

Local only, requires a rare offload-failure race plus admin-driven interface teardown (AC:H/PR:H); realistic impact is a crash (A:H) with no demonstrated confidentiality/integrity loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jun 28, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

Jun 24, 2026 - 18:02 EUVD

CVE Published

Jun 24, 2026 - 16:29 cve.org

HIGH 7.8

CVE Published

Jun 24, 2026 - 16:29 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ice: fix double-free of tx_buf skb

If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time.

The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path.

The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.

I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.

I looked for similar bugs in related Intel drivers and did not find any.

Executive ViewAI

Why It Matters

CVE-2026-53009 is a privilege escalation vulnerability in the Linux kernel's Intel ice network driver allowing unprivileged local users to gain administrative access through memory corruption. This impacts organizations operating shared hosting, multi-tenant platforms, or internal systems where local user isolation is a security control. A patch is available; systems with concurrent local user accounts require near-term remediation to prevent lateral movement risks.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

High

Linux kernel ice driver serves common Intel E810 server NICs

Vendor Action

See Below

Not affected (vendor confirmed)

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31