CVE-2026-23104: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23104 is a use-after-free / dangling pointer vulnerability in the Linux kernel's ice network driver, caused by improper cleanup of HWMON (hardware monitoring) resources during devlink reload operations. It was introduced by commit 4da71a77fc3b ("ice: read internal temperature sensor") and published on February 4, 2026. Affected versions span Linux kernel 6.8 through 6.18.7, as well as 6.19-rc1 through 6.19-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local, low-privilege attack vector with high availability impact (Feedly).

The root cause is an asymmetric resource lifecycle in the ice driver (CWE-459: Incomplete Cleanup / dangling pointer). ice_hwmon_init() is called from ice_init_feature() during both initial driver load and devlink reload-up, but ice_hwmon_exit() was only called from ice_remove(). When devlink reload is performed, ice_remove() is not invoked during the reload-down phase, so a second HWMON instance is created on reload-up. Upon driver unload, only the second instance is cleaned up via ice_remove(), leaving the first instance's sysfs attributes pointing to freed module memory. System monitoring tools such as sadc that periodically read hwmon sysfs attributes then trigger a kernel page fault (BUG: unable to handle page fault for address) approximately every 10 minutes. The fix relocates ice_hwmon_exit() to ice_deinit_features() to mirror the initialization path (Feedly, Kernel Patch 1, Kernel Patch 2).

Exploitation of this vulnerability results in repeated kernel page faults triggered by system monitoring tools attempting to read orphaned hwmon sysfs attributes that reference freed module memory. The call trace occurs approximately every 10 minutes, causing kernel warnings and potential system instability or crashes on affected hosts running Intel ice NIC drivers. There is no confidentiality or integrity impact; the vulnerability is limited to availability, and does not enable privilege escalation, lateral movement, or data exfiltration (Feedly).

• Logs: Kernel log entries containing BUG: unable to handle page fault for address: ffffffffc0fd4b5d or similar addresses in freed module memory space; repeated call traces involving name_show, dev_attr_show, sprintf, vsnprintf, and string functions in /var/log/kern.log or dmesg output.
• Process Behavior: Periodic (approximately every 10 minutes) kernel oops or page fault events coinciding with system monitoring tool activity (e.g., sadc, sar, or similar HWMON readers).
• File System: Presence of orphaned hwmon sysfs entries under /sys/class/hwmon/ that remain accessible after driver reload but reference invalid memory; multiple hwmon device entries for the same ice NIC interface.

Update to Linux kernel version 6.18.8 or later, or 6.19-rc7 or later, which include the fix relocating ice_hwmon_exit() to ice_deinit_features(). Downstream distributions including SUSE and Debian have issued kernel updates incorporating this fix (SUSE advisory suse-2026-0962-1, Debian DSA-6238-1). As a temporary workaround on unpatched systems, avoid performing devlink reload operations on interfaces using the ice driver, and suppress or disable hwmon sysfs polling by system monitoring tools to reduce the frequency of page fault events (Feedly, SUSE Advisory, Debian Advisory).

The vulnerability received routine coverage from vulnerability tracking platforms including VulnDB and Vulners shortly after publication. SUSE and Debian both issued kernel security advisories incorporating the fix. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No notable researcher commentary or significant social media discussion has been identified beyond standard CVE tracking (SUSE Advisory, Debian Advisory).