CVE-2026-72425
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel ice driver, there is a resource leak of CTRL VSI when resetting all VFs with FDIR filters enabled. The ice_reset_all_vfs() function only invalidates CTRL VSIs but does not free them, leading to resource leak. The fix uses ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi(), aligning with the behavior of ice_reset_vf().
Risk Assessment
Resource leak may lead to exhaustion of memory or other system resources, potentially causing system instability or unavailability of network services.
Recommendation
Update the Linux kernel to a version containing the fix, and avoid frequent resets of all VFs if possible.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated and not freed. Fix by using ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which aligns behavior with the ice_reset_vf() function. Reproduction: echo 1 > /sys/class/net/$pf/device/sriov_numvfs ethtool -N $vf flow-type ether proto 0x9000 action 0 echo 1 > /sys/class/net/$pf/device/reset