CVE-2026-99043

In the Linux kernel, the following vulnerability has been resolved:

ice: fix metadata dst refcount handling on representor teardown

ice eswitch release repr() uses metadata dst free() to release the representor's metadata dst. metadata dst free() directly frees the underlying memory without checking the dst entry refcount.

When ice eswitch port start xmit() processes a packet, it takes a reference via dst hold() and attaches the metadata dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata dst is freed while references are still held.

Use dst release() instead, which correctly decrements the refcount and only frees the object when all references are dropped. The dst subsystem already handles metadata dst cleanup in dst destroy() when DST METADATA is set.

Other drivers sharing this pattern (nfp, airoha, bnxt) already use dst release() for their metadata dst lifecycle.