HIGH Introduced in 6.12
ice ParserProfile OOB
CVE-2026-68128
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault. Reproduced with a custom kernel module injecting a crafted VIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8086:1592), FW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0, kernel 7.1.0-rc1. crash_parser: ice_parser_profile_init @ ffffffffc0d61b60 crash_parser: setting ptype=0xffff (max valid=1023) crash_parser: calling ice_parser_profile_init -- expect OOB crash! BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1 Hardware name: Intel Corporation S2600BPB/S2600BPB RIP: 0010:ice_parser_profile_init+0x2d/0x1d0 [ice] Call Trace: <TASK> ? __pfx_ice_parser_profile_init+0x10/0x10 [ice] crash_init+0x127/0xff0 [crash_parser] do_one_initcall+0x45/0x310 do_init_module+0x64/0x270 init_module_from_file+0xcc/0xf0 idempotent_init_module+0x17b/0x280 __x64_sys_finit_module+0x6e/0xe0 Bail out early with -EINVAL when ptype is out of range.
02KernelScan AI Analysis
Risk summary
A guest VM or container assigned an SR-IOV virtual function on an Intel E810 NIC can send a crafted VIRTCHNL configuration message that causes an out-of-bounds write in the host kernel's ice driver. This can corrupt host kernel memory, leading to kernel crash or potential VM escape with arbitrary read/write primitives. Any multi-tenant deployment using SR-IOV VFs on affected Intel hardware is at risk.
Vulnerability analysis
The Intel ice network driver processes SR-IOV virtual function configuration messages without validating a packet-type field against the size of an internal bitmap. A guest VM assigned a virtual function on an Intel E810 NIC can send a crafted configuration message carrying an out-of-range packet type, causing the host kernel driver to write past the end of the bitmap and corrupt adjacent kernel memory. The fix adds a bounds check that rejects any packet-type value exceeding the bitmap capacity before the write occurs. The vulnerable path is reachable from any guest VM or container that has been assigned an SR-IOV virtual function on affected Intel hardware; no host-level privileges are required beyond VF assignment.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12 | 6.12.101 | fe2f8d5a77ad |
| 6.18 | 6.12 | 6.18.42 | 5e496f2b615c |
| 7.1 | 6.12 | 7.1.6 | 33cc15aaf249 |
| mainline | 6.12 | 7.2-rc5 | 59abb87159c5 |