UBUNTU-CVE-2026-68128: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbit(rslt->ptype, prof->ptypes) operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault. Reproduced with a custom kernel module injecting a crafted VIRTCHNLOPADDRSSCFG on E810-C QSFP (8086:1592), FW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0, kernel 7.1.0-rc1. crashparser: iceparserprofileinit @ ffffffffc0d61b60 crashparser: setting ptype=0xffff (max valid=1023) crashparser: calling iceparserprofileinit -- expect OOB crash! BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1 Hardware name: Intel Corporation S2600BPB/S2600BPB RIP: 0010:iceparserprofileinit+0x2d/0x1d0 [ice] Call Trace: <TASK> ? pfxiceparserprofileinit+0x10/0x10 [ice] crashinit+0x127/0xff0 [crashparser] dooneinitcall+0x45/0x310 doinitmodule+0x64/0x270 initmodulefromfile+0xcc/0xf0 idempotentinitmodule+0x17b/0x280 x64sysfinitmodule+0x6e/0xe0 Bail out early with -EINVAL when ptype is out of range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ice_parser_profile_init, reject any ptype >= ICE_FLOW_PTYPE_MAX by returning -EINVAL before calling set_bit(rslt->ptype, prof->ptypes).
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the affected Ubuntu kernel packages and the ice driver with a virtual function (VF) that can send VIRTCHNL requests are exposed. The reported reproduction used an Intel E810-C QSFP device.
What does an attacker need to exploit it?
An attacker needs local, low-privileged access in the VF context and must submit a crafted VIRTCHNL_OP_ADD_RSS_CFG request containing a packet type value of 1024 or higher. User interaction is not required.
What is the likely impact of successful exploitation?
An out-of-range packet type causes a write beyond the ice driver's fixed-size bitmap, which can trigger a kernel page fault and crash. The supplied severity vector also rates confidentiality, integrity, and availability impact as high, with scope changed.
How can I tell whether a system may already be affected?
Kernel logs may show an Oops or NULL pointer dereference involving ice_parser_profile_init in the ice module. The reproduced condition logs a packet type such as 0xffff where the maximum valid value is 1023.