What is the CVSS score of CVE-2026-53009?

CVE-2026-53009 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-53009?

CVE-2026-53009 is a privilege escalation vulnerability in the Linux kernel's Intel ice network driver allowing unprivileged local users to gain administrative access through memory corruption.. A patch is available.

How to fix or mitigate CVE-2026-53009?

Within 24 hours: Identify all Linux systems using the Intel ice network driver (verify via 'lspci | grep -i ice' and ethtool driver confirmation). Within 7 days: Apply the kernel security update from your Linux distribution addressing CVE-2026-53009 in the ice driver (consult your vendor-RHEL, Ubuntu, SLES, etc.-for the specific patched kernel version). Within 30 days: Confirm patch deployment across all affected systems; implement local account access controls on any systems with delayed remediation.

Linux Kernel CVE-2026-53009

EUVD-2026-38877 HIGH

Multiple Releases of Same Resource or Handle (CWE-1341)

2026-06-24 Linux

GHSA-67p5-53x6-9j7q

Code Injection Linux Intel

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.1 MEDIUM

Local only, requires a rare offload-failure race plus admin-driven interface teardown (AC:H/PR:H); realistic impact is a crash (A:H) with no demonstrated confidentiality/integrity loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 08:49 vuln.today

CVSS changed

Jun 28, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

Jun 24, 2026 - 18:02 EUVD

CVE Published

Jun 24, 2026 - 16:29 cve.org

HIGH 7.8

CVE Published

Jun 24, 2026 - 16:29 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ice: fix double-free of tx_buf skb

If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time.

The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path.

The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch.

I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN.

I looked for similar bugs in related Intel drivers and did not find any.

AnalysisAI

Local privilege-impacting memory corruption in the Linux kernel's Intel ice network driver allows a double-free of a transmit buffer's skb when the TX offload paths fail. When ice_tso() or ice_tx_csum() return an error, ice_xmit_frame_ring() frees the skb but leaves the 'first' tx_buf still marked ICE_TX_BUF_SKB, so a later ice_clean_tx_ring() during interface teardown frees the same skb a second time. Carries a CVSS 3.1 base of 7.8 (AV:L/PR:L), but with a low EPSS of 0.15% (5th percentile), no KEV listing, and no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in the Intel 'ice' Ethernet driver (drivers/net/ethernet/intel/ice) that supports Intel E800-series (E810) adapters. The TX hot path stages an outgoing packet in a tx_buf descriptor where the 'first' buffer records the owning skb and a type tag (ICE_TX_BUF_SKB) marking it as holding a freeable socket buffer. The root cause is a classic double-free / use-after-free (CWE-415/CWE-416, though the feed lists CWE as N/A): the error path frees the skb but never resets the tx_buf type to ICE_TX_BUF_EMPTY, leaving a dangling owning reference. Because next_to_use is not advanced, normal traffic usually overwrites the stale descriptor and masks the bug, but ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() invoked during interface bring-down will free the already-freed skb again. The 'Code Injection' tag and high integrity/confidentiality impact reflect the general exploitation potential of kernel heap double-frees rather than a demonstrated code-execution primitive.

RemediationAI

Apply the upstream kernel fix, which resets the tx_buf type to ICE_TX_BUF_EMPTY in the TX error path and moves initialization of 'first' earlier so it is valid on the linearization error path; the fix is delivered via the stable-tree commits https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2 and https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd. Patch status: upstream fix available as stable commits; consume it through your distribution's patched kernel package rather than an independently confirmed tagged release. Because the affected code is core TX handling within the ice driver and not gated by a toggle, there is no clean feature-level workaround; the only meaningful compensating control is to avoid loading/using the ice driver on non-essential hosts (e.g. blacklist the module where the Intel E810 NIC is unused), which obviously disables those interfaces and is impractical where the NIC is the primary uplink. Until patched, limit who can administratively bring interfaces down (restrict CAP_NET_ADMIN) to reduce the chance of triggering the second free.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31