{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-99043",
  "modified": "2026-10-24T04:30:01Z",
  "upstream": [
    "CVE-2026-99043"
  ],
  "published": "2026-10-23T12:29:05Z",
  "summary": "ice: fix metadata_dst refcount handling on representor teardown",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix metadata_dst refcount handling on representor teardown\n\nice_eswitch_release_repr() uses metadata_dst_free() to release the\nrepresentor's metadata_dst.  metadata_dst_free() directly frees the\nunderlying memory without checking the dst_entry refcount.\n\nWhen ice_eswitch_port_start_xmit() processes a packet, it takes a\nreference via dst_hold() and attaches the metadata_dst to the skb.\nIf the representor is torn down while packets are still queued on\nthe lower device (e.g. in a qdisc), the metadata_dst is freed while\nreferences are still held.\n\nUse dst_release() instead, which correctly decrements the refcount\nand only frees the object when all references are dropped.  The dst\nsubsystem already handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set.\n\nOther drivers sharing this pattern (nfp, airoha, bnxt) already use\ndst_release() for their metadata_dst lifecycle.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-99043"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1f263235651775f93c15d90c9f25c3f4a4ef6512"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6f5544f53f1e58ea8a49fb9f9158d5793b9205b0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/beb05f484a1e4a5a66e3678e4b7f3147f651c080"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5e4d20db5179e83a4948927bc39e489a9a83256d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/58858b8f14803a7eeac297b3ce20f3b21bf2ff66"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-23T12:29:05Z"
  }
}