Executive brief
The Linux kernel's ice network driver (used in Intel network adapters) contains a bug in its Precision Time Protocol (PTP) initialization that causes a kernel crash during driver shutdown when PF reset occurs on uninitialized PTP. This results in system instability and potential denial of service when affected hardware is passed through to virtual machines or encounters certain reset conditions.
Technical details
The vulnerability is a state machine logic error in the ice driver's PTP subsystem (ice_ptp.c). When ice_ptp_init() fails due to a NULL ctrl_pf pointer, the PTP state is set to ICE_PTP_UNINIT. If a subsequent PF reset occurs while in this state, ice_ptp_rebuild() incorrectly transitions the state to ICE_PTP_ERROR, which is an invalid state transition. This leads to a kernel BUG assertion failure in lib/list_debug.c during driver unload when ice_ptp_release() attempts list operations on improperly initialized structures. The fix detects the ICE_PTP_UNINIT state in ice_ptp_rebuild() and returns early without error, preventing the invalid state transition. This issue was observed when passing PF1 through to a VM and affects the ice driver across multiple kernel versions.
Affected products
- Linux Linux kernel Multiple kernel versions (fixes backported from 5.x through 7.x)
Timeline
- 2026-08-10: disclosed
- 2026-08-03: patched: Stable kernel patch committed by Greg Kroah-Hartman