{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "f5396b8a663f7a78ee5b75a47ee524b40795b265"
            },
            {
              "fixed": "41f0d9ab158fb51f34bded5f8a40918e4f70b2b6"
            },
            {
              "fixed": "1f263235651775f93c15d90c9f25c3f4a4ef6512"
            },
            {
              "fixed": "6f5544f53f1e58ea8a49fb9f9158d5793b9205b0"
            },
            {
              "fixed": "beb05f484a1e4a5a66e3678e4b7f3147f651c080"
            },
            {
              "fixed": "5e4d20db5179e83a4948927bc39e489a9a83256d"
            },
            {
              "fixed": "58858b8f14803a7eeac297b3ce20f3b21bf2ff66"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.191"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.160"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.113"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.57"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99043.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix metadata_dst refcount handling on representor teardown\n\nice_eswitch_release_repr() uses metadata_dst_free() to release the\nrepresentor's metadata_dst.  metadata_dst_free() directly frees the\nunderlying memory without checking the dst_entry refcount.\n\nWhen ice_eswitch_port_start_xmit() processes a packet, it takes a\nreference via dst_hold() and attaches the metadata_dst to the skb.\nIf the representor is torn down while packets are still queued on\nthe lower device (e.g. in a qdisc), the metadata_dst is freed while\nreferences are still held.\n\nUse dst_release() instead, which correctly decrements the refcount\nand only frees the object when all references are dropped.  The dst\nsubsystem already handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set.\n\nOther drivers sharing this pattern (nfp, airoha, bnxt) already use\ndst_release() for their metadata_dst lifecycle.",
  "id": "CVE-2026-99043",
  "modified": "2026-11-01T02:30:21.811884162Z",
  "published": "2026-10-23T12:22:07.372Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f263235651775f93c15d90c9f25c3f4a4ef6512"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/41f0d9ab158fb51f34bded5f8a40918e4f70b2b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/58858b8f14803a7eeac297b3ce20f3b21bf2ff66"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e4d20db5179e83a4948927bc39e489a9a83256d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6f5544f53f1e58ea8a49fb9f9158d5793b9205b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/beb05f484a1e4a5a66e3678e4b7f3147f651c080"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99043.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99043"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "ice: fix metadata_dst refcount handling on representor teardown"
}