CVE-2025-39948

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix Rx page leak on multi-buffer frames

The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each

buffer in the current frame. This function was introduced as part of

handling multi-buffer XDP support in the ice driver.

It works by iterating over the buffers from first_desc up to 1 plus the

total number of fragments in the frame, cached from before the XDP program

was executed.

If the hardware posts a descriptor with a size of 0, the logic used in

ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added

as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a

fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't

call ice_put_rx_buf().

Because we don't call ice_put_rx_buf(), we don't attempt to re-use the

page or free it. This leaves a stale page in the ring, as we don't

increment next_to_alloc.

The ice_reuse_rx_page() assumes that the next_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References