CVE-2026-72425

In the Intel ice driver, ice_reset_all_vfs() leaks CTRL VSI resources on every bulk VF reset when those VFs have active Flow Director filters. The function calls ice_vf_ctrl_invalidate_vsi() instead of ice_release_vf_ctrl_vsi(), which marks the VSI as invalid without freeing the underlying kernel resources. This is a one-line fix (swap the function call), but the implications are larger than the CVSS 7.1 suggests. The leak is gated by FDIR — it only manifests when a VF carries active Flow Director filters, which are used in high-performance networking, firewall appliances, and NFV workloads. In these environments, VF lifecycle management is typically automated by orchestration systems, meaning the leak accumulates silently in production without triggering any obvious errors until a threshold is crossed. The ice driver's CTRL VSIs are shared substrate resources across the physical function, so the leak creates resource pressure that degrades the reliability of every VF on that PF, not just the resetting one. The root cause is a split-personality API: the driver provides both an invalidate function and a release function that look interchangeable but have different runtime guarantees. Developers optimizing the bulk reset path chose the "cheaper" invalidation route because it performed faster in isolation, without accounting for accumulated state across reset cycles. The individual VF reset path (ice_reset_vf()) does the right thing — the bug lives specifically in the bulk operation where performance pressure is most acute. Check whether your ice-driven systems run FDIR-filtered workloads with automated VF lifecycle management. If so, monitor CTRL VSI counts over time. The compounding nature means this isn't a single-event crash — it's a slow resource exhaustion that won't surface in casual testing but will degrade subsystem reliability in production environments cycling VFs continuously.

Reviewed through automated stages and approved by a human before publication.