Executive brief
The Intel ICE network driver in the Linux kernel improperly validates input from virtual functions, allowing an attacker to write beyond the bounds of a kernel bitmap. A malicious virtual machine or container could trigger a kernel crash, causing denial of service to the host system and potentially disrupting network connectivity for all users sharing the physical network adapter.
Technical details
The vulnerability is a bounds-check bypass in the ice_parser_profile_init() function. The code uses set_bit(rslt->ptype, prof->ptypes) to set a bit in a 1024-bit bitmap without validating that ptype is less than ICE_FLOW_PTYPE_MAX (1024). A malicious virtual function can provide an out-of-range ptype value (e.g., 0xffff) via the VIRTCHNL_OP_ADD_RSS_CFG message, causing an out-of-bounds memory write and kernel NULL pointer dereference. The fix adds a simple bounds check (if (rslt->ptype >= ICE_FLOW_PTYPE_MAX) return -EINVAL) at the start of the function. No authentication is required—any guest with a virtual function interface can trigger the crash. The patch was merged into the Linux mainline and stable kernels in July–August 2026.
Affected products
- Linux Linux kernel 5.0 and later
Timeline
- 2026-07-17: disclosed: Fix committed upstream by Aleksandr Loktionov
- 2026-07-23: patched: Fix merged to mainline (commit 59abb87159c53605c063f6e2ceb215b5eba43ee6)
- 2026-08-03: patched: Fix backported to stable kernels (commit 33cc15aaf2491166dddc018b24b3b7db53ec01b2)