CVE-2026-43346: Linux Kernel PTP Control Vulnerability

CVE-2026-43346 Overview

CVE-2026-43346 is a reachable assertion vulnerability [CWE-617] in the Linux kernel's Intel Ethernet (ice) driver Precision Time Protocol (PTP) subsystem. The flaw resides in ice_ptp_setup_pf(), which calls WARN_ON() when ice_get_ctrl_ptp() returns NULL. This condition occurs legitimately in VFIO passthrough configurations where only a Physical Function (PF) that does not own the source timer is passed through to a virtual machine. The controlling PF (adapter->ctrl_pf) is never initialized inside the guest, triggering an unnecessary kernel warning.

Critical Impact
A local low-privileged user in a VM with a passed-through PF that does not own the PTP source timer can trigger kernel warnings, potentially leading to availability impact on systems configured with panic_on_warn.

Affected Products

Linux Kernel 7.0-rc1 through 7.0-rc7
Linux Kernel stable branches prior to fix commits
Systems using the Intel ice Ethernet driver with PTP in VFIO passthrough setups

Discovery Timeline

2026-05-08 - CVE-2026-43346 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43346

Vulnerability Analysis

The vulnerability exists in the Intel ice driver's PTP initialization path. In VFIO passthrough deployments, administrators can assign a single PF to a guest VM. When that PF does not own the PTP source timer, the controlling PF reference (adapter->ctrl_pf) remains uninitialized within the guest kernel context.

During driver setup, ice_ptp_setup_pf() invokes ice_get_ctrl_ptp() to retrieve the controlling PTP instance. When this function returns NULL, the code path executes WARN_ON(), which emits a kernel backtrace. On kernels built or booted with panic_on_warn, this warning escalates to a kernel panic, causing denial of service.

The issue is one of incorrect error handling rather than memory corruption. The expected VFIO passthrough configuration is mistakenly treated as an exceptional condition. The fix replaces WARN_ON() with an informational message and returns -EOPNOTSUPP to signal that PTP is unsupported in this configuration.

Root Cause

The root cause is the inappropriate use of WARN_ON() for a known and supported runtime condition. The driver assumed the controlling PF would always be available, but VFIO passthrough configurations break that assumption without representing an actual error state.

Attack Vector

Exploitation requires local access with low privileges inside a VM that has been configured with a non-source-timer PF via VFIO passthrough. No user interaction is needed. The attacker triggers driver initialization paths that reach ice_ptp_setup_pf(), producing kernel warnings. Systems with panic_on_warn enabled experience denial of service.

No verified public exploit or proof-of-concept code is available for this issue. See the upstream commits referenced below for technical details on the affected code paths.

Detection Methods for CVE-2026-43346

Indicators of Compromise

Kernel log entries containing WARN_ON backtraces originating from ice_ptp_setup_pf in /var/log/kern.log or dmesg output.
Repeated kernel taint events on guest VMs running the ice driver after VFIO PF assignment.
Unexpected guest kernel panics on hosts configured with panic_on_warn=1 and PTP-enabled Intel network adapters.

Detection Strategies

Monitor guest VM kernel ring buffers for ice_ptp_setup_pf warning signatures using log aggregation pipelines.
Inventory VMs receiving VFIO passthrough of Intel ice PFs and verify which PF owns the PTP source timer.
Correlate guest VM availability events with ice driver load times to identify warning-triggered instability.

Monitoring Recommendations

Forward dmesg and journald kernel facility logs from guest VMs to a centralized SIEM for pattern matching.
Alert on kernel taint flag transitions (/proc/sys/kernel/tainted) on hosts running affected kernels.
Track Linux kernel versions across the fleet and flag systems running 7.0-rc1 through 7.0-rc7 with the ice driver loaded.

How to Mitigate CVE-2026-43346

Immediate Actions Required

Apply the upstream kernel patches referenced in the Linux stable tree commits bb3f21edc705, c73f365707d3, and e19675b384e9.
Disable panic_on_warn on systems where guest VM availability is critical and the patch cannot be applied immediately.
Audit VFIO passthrough configurations to identify guests receiving Intel ice PFs that do not own the PTP source timer.

Patch Information

The fix replaces the WARN_ON() call with an informational log message and returns -EOPNOTSUPP from ice_ptp_setup_pf(). Patches are available in the upstream stable tree: Kernel Git Commit bb3f21edc705, Kernel Git Commit c73f365707d3, and Kernel Git Commit e19675b384e9.

Workarounds

Configure VFIO passthrough to assign only the PF that owns the PTP source timer when PTP functionality is required in the guest.
Avoid loading the ice driver inside guest VMs that receive non-controlling PFs until the patch is applied.
Set sysctl kernel.panic_on_warn=0 on affected hosts and guests to prevent warning-induced panics.

bash

# Verify panic_on_warn is disabled to prevent DoS from kernel warnings
sysctl -w kernel.panic_on_warn=0

# Check loaded ice driver version on guest VMs
modinfo ice | grep -E '^(version|filename)'

# Inspect kernel ring buffer for ice_ptp warnings
dmesg | grep -i 'ice_ptp_setup_pf'