CVE-2026-68292: Linux Kernel Information Disclosure Flaw

CVE-2026-68292 Overview

CVE-2026-68292 is a memory leak vulnerability in the Linux kernel's ice network driver, which supports Intel Ethernet controllers. The flaw exists in the ETF (Earliest TxTime First) offload handling logic, where ice_is_txtime_ena() fails to distinguish between Physical Function (PF) VSI and Control (CTRL) VSI queue types when consulting the pf->txtime_txqs bitmap. Each PCI reset event leaks one 64-byte tstamp_ring allocation on affected systems that have ETF offload enabled on PF Tx queue 0.

Critical Impact
Repeated PCI resets progressively exhaust kernel memory through leaked tstamp_ring allocations, degrading system stability over time on hosts using Intel ice NICs with ETF offload.

Affected Products

Linux kernel (versions containing the ice driver with ETF offload support)
Systems using Intel Ethernet controllers managed by the ice driver
Kernel builds prior to the commits referenced in the upstream stable tree

Discovery Timeline

2026-08-10 - CVE-2026-68292 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68292

Vulnerability Analysis

The pf->txtime_txqs bitmap in the Intel ice driver tracks which Tx queues have ETF offload enabled. This bitmap is indexed by queue number and is populated exclusively by ice_offload_txtime(), which operates only on PF VSI queues. The function ice_is_txtime_ena() consults this bitmap to determine whether a given ring requires a timestamp ring allocation.

The root defect is that ice_is_txtime_ena() does not validate the VSI type before checking the bitmap. When ETF offload is active on PF Tx queue 0, bit 0 is set. During a PCI reset rebuild, the CTRL VSI's Tx queue 0 is reconfigured and passes through the same code path. The function incorrectly returns true for the CTRL VSI ring because bit 0 remains set from the PF VSI.

This false positive causes ice_vsi_cfg_txq() to allocate a tstamp_ring for the CTRL VSI ring. Because CTRL VSI rings lack an associated netdev, ice_clean_tx_ring() returns early at the !netdev check and never reaches ice_free_tx_tstamp_ring(). The allocation is orphaned.

Root Cause

The root cause is missing VSI type validation in ice_is_txtime_ena(). The txtime_txqs bitmap is semantically meaningful only for PF VSI queues, but the function treats it as universally applicable across all VSI types sharing the same queue index space.

Attack Vector

This is a kernel memory leak triggered by legitimate PCI reset operations, not a directly exploitable vulnerability. Repeated resets, which can occur under fault conditions or administrative actions, progressively leak 64-byte allocations. The issue requires ETF offload to be enabled on PF Tx queue 0 and does not appear to allow remote or unprivileged local triggering.

The vulnerability manifests in the driver's queue configuration path. See the referenced kernel.org commits for the complete technical patch details.

Detection Methods for CVE-2026-68292

Indicators of Compromise

Growth in kernel kmalloc-64 slab consumption over time on hosts with Intel ice NICs.
Repeated PCI reset events for ice devices logged in dmesg or the kernel journal.
Presence of ETF offload configuration on PF Tx queues via tc-etf(8) qdisc setup.

Detection Strategies

Monitor /proc/slabinfo for abnormal growth in small kernel allocations correlated with ice driver reset events.
Audit installed kernel package versions against the upstream stable branches that include commits 144539b, 684d4d0, and d0a2160.
Correlate ice driver log entries with slab and memory pressure telemetry to identify affected hosts.

Monitoring Recommendations

Track PCI reset frequency for Intel ice interfaces and alert on unexpected reset storms.
Baseline kernel memory usage on hosts running networking workloads with ETF offload, and alert on unexplained upward drift.
Include kernel version inventory in configuration management to identify unpatched systems quickly.

How to Mitigate CVE-2026-68292

Immediate Actions Required

Identify all Linux hosts running the Intel ice driver with ETF offload configured on PF Tx queues.
Schedule kernel updates to a stable release that includes the referenced upstream fixes.
Reduce unnecessary PCI reset triggers on affected hosts until patching is complete.

Patch Information

The fix restricts ice_is_txtime_ena() to return true only for PF VSI rings, ensuring the txtime_txqs bitmap is consulted only in the context where it is semantically valid. The patch is available in the Linux stable tree via commits Kernel.org Commit 144539b, Kernel.org Commit 684d4d0, and Kernel.org Commit d0a2160. Apply the vendor-supplied kernel package that incorporates these commits.

Workarounds

Disable ETF offload on PF Tx queues where feasible, removing the trigger condition for the leak.
Reboot affected hosts periodically to reclaim leaked kernel memory until patches are applied.
Avoid administrative operations that cause repeated PCI resets on ice interfaces on unpatched systems.

bash

# Check loaded ice driver version and ETF qdisc configuration
modinfo ice | grep -E '^(version|filename):'
tc qdisc show | grep etf

# Identify current kernel version against patched stable releases
uname -r