CVE-2026-68128
High · 8.8CVSS
8.8
EPSS
0.1%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in certain Intel network card drivers lets a virtual machine send bad data that can crash the whole host computer.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds write via set_bit on a 1024-bit DECLARE_BITMAP when a malicious VF supplies ptype >= 1024 through VIRTCHNL_OP_ADD_RSS_CFG, causing write beyond the bitmap and subsequent kernel NULL pointer dereference in ice_parser_profile_init.
Why it matters to the business
Systems using affected Intel E810 Ethernet controllers in virtualized environments face risk of kernel crashes and denial of service from untrusted virtual functions; 76 days have passed since disclosure with no change in exploitation probability.
How an attack unfolds
An attacker controlling a malicious VF crafts a VIRTCHNL_OP_ADD_RSS_CFG message containing ptype=0xffff and sends it to the PF driver; ice_parser_profile_init receives the value, performs set_bit without range validation, writes past the bitmap end, and triggers a kernel page fault and oops.
How to fix it
Apply the upstream kernel patch that adds an early -EINVAL check for ptype >= ICE_FLOW_PTYPE_MAX in ice_parser_profile_init; update to a fixed kernel release containing this change.
How to confirm the fix worked
Confirm the presence of the range check 'if (ptype >= ICE_FLOW_PTYPE_MAX) return -EINVAL;' in ice_parser_profile_init; attempt reproduction with a test module and verify it now returns failure instead of crashing.
Typical attack path
- Obtain or create a malicious VF on an affected Intel E810 device
- Craft VIRTCHNL_OP_ADD_RSS_CFG with ptype >= 1024
- Inject the message via the virtchnl interface
- Trigger ice_parser_profile_init to perform the out-of-bounds set_bit
- Cause kernel NULL dereference and system crash
How to detect it
Search kernel logs for oops or BUG entries containing 'ice_parser_profile_init', 'ptype=0xffff', 'max valid=1023', or the call trace starting at ice_parser_profile_init+0x2d; inspect virtchnl messages for RSS_CFG with out-of-range ptype values.
- ice_parser_profile_init
- ptype=0xffff (max valid=1023)
- crash_parser: setting ptype
- BUG: kernel NULL pointer dereference
- ice_parser_profile_init+0x2d/0x1d0 [ice]
What your security team should do
- Prioritize kernel updates on hosts exposing Intel ice VFs to untrusted guests
- Monitor for kernel oops involving ice_parser_profile_init
- Restrict VF creation or RSS configuration privileges where feasible until patched
The record
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault. Reproduced with a custom kernel module injecting a crafted VIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8086:1592), FW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0, kernel 7.1.0-rc1. crash_parser: ice_parser_profile_init @ ffffffffc0d61b60 crash_parser: setting ptype=0xffff (max valid=1023) crash_parser: calling ice_parser_profile_init -- expect OOB crash! BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1 Hardware name: Intel Corporation S2600BPB/S2600BPB RIP: 0010:ice_parser_profile_init+0x2d/0x1d0 [ice] Call Trace: <TASK> ? __pfx_ice_parser_profile_init+0x10/0x10 [ice] crash_init+0x127/0xff0 [crash_parser] do_one_initcall+0x45/0x310 do_init_module+0x64/0x270 init_module_from_file+0xcc/0xf0 idempotent_init_module+0x17b/0x280 __x64_sys_finit_module+0x6e/0xe0 Bail out early with -EINVAL when ptype is out of range.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|