Cloudanix VulnDB

CVE-2026-68133

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a Linux network driver can make certain servers crash when the driver is removed after a hardware reset in virtual setups.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Invalid PTP state transition from ICE_PTP_UNINIT to ICE_PTP_ERROR during rebuild after PF reset triggers a kernel BUG in list debugging during driver unload, causing a crash.

Why it matters to the business

Systems using affected Intel network hardware in virtualized or SR-IOV configurations may experience unexpected kernel panics and service interruptions during driver removal or reset handling, increasing downtime risk in high-availability environments.

How an attack unfolds

An attacker with local access or control over a VM that receives a passed-through PF can induce a PF reset while the PTP state remains uninitialized, forcing the erroneous state change on rebuild that later crashes the host kernel on unload.

How to fix it

Update the Linux kernel to a version containing the fix that checks for ICE_PTP_UNINIT in ice_ptp_rebuild and returns early without state transition. Rebuild and redeploy the ice driver module after patching.

How to confirm the fix worked

Confirm the presence of the state check for ICE_PTP_UNINIT at the start of ice_ptp_rebuild in the source or running module; test driver load/unload cycles after simulated PF resets in passthrough configurations.

Typical attack path

  1. Gain access to a VM with PF passthrough of an ice device
  2. Trigger conditions that cause ice_ptp_init to fail and leave state as ICE_PTP_UNINIT
  3. Cause a PF reset while in that state
  4. Trigger ice_ptp_rebuild which incorrectly sets ICE_PTP_ERROR
  5. Unload the ice driver to hit the BUG in ice_ptp_release

How to detect it

Inspect kernel logs for the specific call trace containing ice_ptp_release, ice_deinit_features, and the list_debug BUG; correlate with driver unload events and prior PF reset activity on ice devices.

What your security team should do

  • Prioritize kernel updates on systems using ice driver with SR-IOV or VM passthrough
  • Monitor for kernel oops involving ice_ptp_release during driver unload
  • Test reset and unload sequences in lab environments matching production virtualization setups

The record

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then ice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will result in the following PTP release call trace during driver unload: kernel BUG at lib/list_debug.c:52! ice_ptp_release+0x332/0x3c0 [ice] ice_deinit_features.part.0+0x10e/0x120 [ice] ice_remove+0x100/0x220 [ice] This was observed when passing PF1 through to a VM. ice_ptp_init() fails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT. Fix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and returning without error, preventing the invalid state transition to ICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from ICE_PTP_RESETTING after a failed rebuild.

Affected packages

Ecosystem Package Introduced Fixed