In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown… (CVE-2026-99043)

The Linux kernel's ice driver had a flaw in the function ice_eswitch_release_repr() where metadata_dst_free() was used to release the representor's metadata_dst. This function freed memory without checking the dst_entry reference count, causing premature freeing if the representor was torn down while packets were still queued. The fix replaced metadata_dst_free() with dst_release(), which properly decrements the reference count and only frees the object when all references are dropped. This aligns with the existing handling in other drivers like nfp, airoha, and bnxt.

Improper reference count handling could lead to use-after-free conditions, which may cause memory corruption or kernel instability. However, no known exploits in the wild have been reported for this vulnerability.

A fix is available that replaces metadata_dst_free() with dst_release() in the ice driver to correctly manage reference counts. Users should apply the official Linux kernel updates that include this patch to remediate the issue.