CVE-2026-68292

Received Received - Intake

Memory Leak in Linux Kernel Ice Driver

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf->txtime_txqs bitmap tracks which Tx queues have ETF (Earliest TxTime First) offload enabled. This bitmap is indexed by queue number and is set by ice_offload_txtime(), which only operates on PF VSI queues. However, ice_is_txtime_ena() does not check the VSI type before consulting the bitmap. When ETF offload is enabled on PF Tx queue 0, bit 0 is set in pf->txtime_txqs. During a subsequent PCI reset rebuild, the CTRL VSI's Tx queue 0 is reconfigured and ice_is_txtime_ena() is called for that ring. Since it only checks pf->txtime_txqs by queue index without distinguishing VSI type, it finds bit 0 set and returns true, matching the PF VSI's ETF queue, not the CTRL VSI's. This causes ice_vsi_cfg_txq() to spuriously allocate a tstamp_ring for the CTRL VSI ring. Since CTRL VSI rings have no associated netdev, ice_clean_tx_ring() takes an early return at the !netdev check before reaching ice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset leaks one 64-byte tstamp_ring. Fix this by restricting ice_is_txtime_ena() to return true only for PF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68292

EUVD

EUVD-2026-55393

Affected Vendors & Products

Vendor	Product	Version / Range
intel	ice	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the Intel ICE driver where a bitmap tracking ETF offload queues for PF VSI types is incorrectly accessed for non-PF VSI types like CTRL VSI. This causes spurious allocation of timestamp rings during PCI reset rebuilds, leading to memory leaks since CTRL VSI rings lack netdev associations.

Detection Guidance

This vulnerability is specific to the Linux kernel's ice driver for Intel NICs. Detection requires checking kernel logs for tstamp ring allocation errors during PCI reset rebuilds. Monitor dmesg for messages like 'tstamp ring allocation failed' or 'leaked tstamp ring' after system resets. Use 'dmesg | grep -i tstamp' to search logs.

Impact Analysis

The vulnerability causes memory leaks during PCI reset operations, consuming 64 bytes per reset. While not directly exploitable, it may lead to resource exhaustion over time, potentially causing system instability or performance degradation on affected systems using Intel ICE network interfaces.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. It is a memory leak issue in the Linux kernel's ice driver affecting Tx queue management, which does not involve data exposure or privacy concerns relevant to these regulations.

Mitigation Strategies

Apply the kernel patch that restricts ice_is_txtime_ena() to PF VSI rings. Update to a fixed kernel version where this issue is resolved. If immediate patching is not possible, avoid unnecessary PCI resets on systems using Intel ice NICs.

Hi! I’m here to help you understand CVE-2026-68292. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70