{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6"
            },
            {
              "fixed": "2ca30340b5028ddc3f17086a538feeff06167b1b"
            },
            {
              "fixed": "121d1f253aed515cd85748f68c664a6cb756e8ad"
            },
            {
              "fixed": "d0c6a4816609f145ffcc74e64baa214c571c17c6"
            },
            {
              "fixed": "9aab1c3d7299285e2569cbc0ed5892d631a241b2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.12.0"
            },
            {
              "fixed": "6.12.88"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.30"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46162.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double free in ice_sf_eth_activate() error path\n\nWhen auxiliary_device_add() fails, ice_sf_eth_activate() jumps to\naux_dev_uninit and calls auxiliary_device_uninit(\u0026sf_dev-\u003eadev).\n\nThe device release callback ice_sf_dev_release() frees sf_dev, but\nthe current error path falls through to sf_dev_free and calls\nkfree(sf_dev) again, causing a double free.\n\nKeep kfree(sf_dev) for the auxiliary_device_init() failure path, but\navoid falling through to sf_dev_free after auxiliary_device_uninit().",
  "id": "CVE-2026-46162",
  "modified": "2026-07-15T01:49:00.536300332Z",
  "published": "2026-05-28T09:36:17.479Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46162.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46162"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "summary": "ice: fix double free in ice_sf_eth_activate() error path"
}