UBUNTU-CVE-2026-68133: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild() will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver unload: kernel BUG at lib/listdebug.c:52! iceptprelease+0x332/0x3c0 [ice] icedeinitfeatures.part.0+0x10e/0x120 [ice] iceremove+0x100/0x220 [ice] This was observed when passing PF1 through to a VM. iceptpinit() fails because ctrlpf is NULL and sets the state to ICEPTPUNINIT. Fix by detecting the ICEPTPUNINIT state in iceptprebuild() and returning without error, preventing the invalid state transition to ICEPTPERROR. The only valid path to ICEPTPERROR is from ICEPTPRESETTING after a failed rebuild.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ice_ptp_rebuild(), detect the ICE_PTP_UNINIT state and return without error to prevent the invalid transition to ICE_PTP_ERROR.
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
The issue was observed when an Intel ice driver physical function (PF1) was passed through to a virtual machine. It affects the listed Ubuntu kernel packages that include the ice driver.
What condition triggers the failure?
A PF reset must occur while PTP is in the ICE_PTP_UNINIT state, followed by driver unload or PTP release. In the observed passthrough scenario, PTP initialization fails because ctrl_pf is NULL, leaving PTP uninitialized.
What happens if the vulnerable path is reached?
The driver can transition PTP from ICE_PTP_UNINIT to ICE_PTP_ERROR incorrectly. A subsequent PTP release during driver unload can trigger a kernel BUG in list_debug.c and produce a call trace.
Is there a configuration-based mitigation if an updated kernel cannot be deployed immediately?
The reported scenario involves passing an ice PF through to a VM. Avoiding that PF passthrough configuration prevents the specific observed path where ctrl_pf is NULL and PTP initialization remains uninitialized.