CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init
In the Linux kernel, the following vulnerability has been resolved:
ice: reject out-of-range ptype in iceparserprofileinit
setbit(rslt->ptype, prof->ptypes) operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault.
Reproduced with a custom kernel module injecting a crafted VIRTCHNLOPADDRSSCFG on E810-C QSFP (8086:1592), FW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0, kernel 7.1.0-rc1.
crashparser: iceparserprofileinit @ ffffffffc0d61b60 crashparser: setting ptype=0xffff (max valid=1023) crashparser: calling iceparserprofileinit -- expect OOB crash! BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1 Hardware name: Intel Corporation S2600BPB/S2600BPB RIP: 0010:iceparserprofileinit+0x2d/0x1d0 [ice] Call Trace: <TASK> ? pfxiceparserprofileinit+0x10/0x10 [ice] crashinit+0x127/0xff0 [crashparser] dooneinitcall+0x45/0x310 doinitmodule+0x64/0x270 initmodulefromfile+0xcc/0xf0 idempotentinitmodule+0x17b/0x280 x64sysfinitmodule+0x6e/0xe0
Bail out early with -EINVAL when ptype is out of range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 7.1.0-rc1 - Configuration
Update the ice driver logic so ice_parser_profile_init rejects invalid ptype values (ptype out of range) and returns -EINVAL instead of proceeding to set_bit on the DECLARE_BITMAP.
Linux kernel (ice driver/module) Bail out early with -EINVAL when ptype is out of range = -EINVAL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68128?
CVE-2026-68128 has a risk score of 55, indicating a moderate severity level.
How do I fix CVE-2026-68128?
To fix CVE-2026-68128, update to the latest version of the Linux kernel where this vulnerability has been resolved.
What systems are affected by CVE-2026-68128?
CVE-2026-68128 affects the Linux kernel, particularly versions prior to the patch that addresses this vulnerability.
What type of vulnerability is CVE-2026-68128?
CVE-2026-68128 is categorized as a Null Pointer Dereference vulnerability.
Can CVE-2026-68128 be exploited remotely?
Yes, CVE-2026-68128 could potentially be exploited by a malicious virtual function (VF) to leverage out-of-range ptypes.