CVE-2026-68128: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68128 Overview

CVE-2026-68128 is an out-of-bounds write vulnerability in the Linux kernel ice driver for Intel Ethernet Controller E810 devices. The flaw exists in the ice_parser_profile_init function, which uses set_bit(rslt->ptype, prof->ptypes) on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. A malicious Virtual Function (VF) can supply a ptype value greater than or equal to 1024 via a crafted VIRTCHNL_OP_ADD_RSS_CFG message, causing a write past the end of the bitmap and a kernel page fault.

Critical Impact
A malicious VF can trigger an out-of-bounds write in the host kernel, resulting in kernel memory corruption, denial of service, or potential privilege escalation from a guest context.

Affected Products

Linux kernel ice driver (Intel Ethernet 800 Series)
Reproduced on Intel E810-C QSFP (PCI ID 8086:1592) with FW 4.91 0x800214af 1.3909.0 and ICE COMMS DDP 1.3.53.0
Kernel version 7.1.0-rc1 (per reproducer report)

Discovery Timeline

2026-08-10 - CVE-2026-68128 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68128

Vulnerability Analysis

The vulnerability resides in ice_parser_profile_init, part of the Intel ice network driver responsible for programming flow parser profiles. The function calls set_bit(rslt->ptype, prof->ptypes) where prof->ptypes is a static bitmap sized to ICE_FLOW_PTYPE_MAX (1024 bits). The driver never validates that rslt->ptype falls within [0, 1023] before invoking set_bit.

When ptype exceeds the bitmap size, set_bit computes a word offset beyond the allocated bitmap storage and issues an atomic OR into unrelated kernel memory. The public reproducer set ptype = 0xFFFF, producing a NULL pointer dereference at address 0x0000000000000000 and an Oops: 0002 kernel fault inside ice_parser_profile_init+0x2d/0x1d0.

Because ptype values reach the driver through the VIRTCHNL interface (specifically VIRTCHNL_OP_ADD_RSS_CFG), any principal able to control a VF, such as a compromised guest with SR-IOV passthrough, can drive kernel state from an untrusted source. This is a classic out-of-bounds write [CWE-787] caused by missing input validation on data crossing a trust boundary.

Root Cause

The root cause is missing bounds validation on the ptype field before it is used as a bit index. The ice driver treats VF-provided parser results as trusted and passes them directly to set_bit, which does not itself perform bounds checking against ICE_FLOW_PTYPE_MAX.

Attack Vector

Exploitation requires the ability to submit VIRTCHNL messages to the Physical Function (PF), which is possible from a Virtual Function driver. In practice this maps to a malicious or compromised guest VM with an assigned VF, or a local privileged process on the host controlling a VF. The reproducer uses a custom kernel module to inject a crafted VIRTCHNL_OP_ADD_RSS_CFG with ptype = 0xFFFF, triggering the out-of-bounds write immediately. No specific exploitation code is publicly available for privilege escalation; observed impact is kernel memory corruption and host crash.

Refer to the upstream fixes for technical detail: Kernel Git Commit 33cc15a, Kernel Git Commit 59abb87, Kernel Git Commit 5e496f2, and Kernel Git Commit fe2f8d5.

Detection Methods for CVE-2026-68128

Indicators of Compromise

Kernel Oops or BUG: kernel NULL pointer dereference entries referencing ice_parser_profile_init in dmesg or /var/log/messages.
Unexpected host reboots or hypervisor crashes on systems using Intel E810 NICs with SR-IOV enabled and untrusted guests.
Guest VMs loading unsigned or unexpected kernel modules that interact with VIRTCHNL_OP_ADD_RSS_CFG.

Detection Strategies

Collect kernel crash dumps (kdump/vmcore) and inspect for faulting RIP values inside the ice module, particularly near ice_parser_profile_init.
Monitor auditd for insmod/finit_module events in guests with attached VFs where the loaded module name is unknown or unsigned.
Alert on VIRTCHNL RSS configuration errors returning -EINVAL from the PF, which after patching indicates rejected out-of-range ptype attempts.

Monitoring Recommendations

Forward kernel logs from hypervisors running SR-IOV-enabled Intel E810 NICs to a central logging platform and alert on ice driver oopses.
Track kernel and driver package versions across the fleet to confirm patched ice builds are deployed.
Correlate guest module-load telemetry with host ice errors to identify guests attempting to abuse the VIRTCHNL interface.

How to Mitigate CVE-2026-68128

Immediate Actions Required

Apply the upstream stable kernel updates that include the ice_parser_profile_init bounds check and rebuild or reinstall the ice driver.
On hypervisors that cannot patch immediately, restrict SR-IOV VF assignment to trusted guests only.
Audit which guests currently have Intel E810 VFs assigned and confirm the loaded guest kernel modules are expected.

Patch Information

The fix rejects out-of-range ptype values by returning -EINVAL early in ice_parser_profile_init before set_bit is called. It is committed upstream and backported through the following stable trees: Kernel Git Commit 33cc15a, Kernel Git Commit 59abb87, Kernel Git Commit 5e496f2, and Kernel Git Commit fe2f8d5. Apply the vendor-provided kernel package that includes these commits.

Workarounds

Disable SR-IOV on affected Intel E810 NICs by setting sriov_numvfs to 0 where VF passthrough is not required.
Detach VFs from any untrusted guest VMs until the patched kernel is deployed.
Restrict loading of custom kernel modules in guests via Secure Boot, kernel lockdown mode, or module signature enforcement.

bash

# Disable all VFs on an affected Intel E810 PF (replace with actual PCI address)
echo 0 | sudo tee /sys/class/net/<ifname>/device/sriov_numvfs

# Verify kernel and ice driver version after patching
uname -r
modinfo ice | grep -E '^(version|filename):'