Linux kernel ice: unchecked VF-supplied ptype writes past a bitmap and faults the host kernel

Impact

ice_parser_profile_init() called set_bit(rslt->ptype, prof->ptypes) on a 1024-bit bitmap without checking the ptype a VF supplied over VIRTCHNL, so a ptype >= 1024 writes past the end of the bitmap. The reporter demonstrated a kernel oops on an E810-C host. On a GPU node this matters where Intel E810 NICs are used for tenant networking with SR-IOV: a guest or tenant that owns a VF reaches host kernel memory it should not, giving at least a host crash that takes every workload on the node with it, and an out-of-bounds write that may be steerable toward privilege escalation. Any node that crashes this way is a node whose in-flight training or inference work is lost, not something you drain cheaply.

Who can reach it

A VF owner - a guest VM or tenant handed an E810 virtual function - sending a crafted VIRTCHNL request such as VIRTCHNL_OP_ADD_RSS_CFG to the host PF driver. No host credentials needed beyond control of the VF; hosts not using ice SR-IOV with untrusted VF consumers are not exposed.

What to do

Update to a stable kernel containing the range check (four stable commits linked) and reboot each host using the ice driver with SR-IOV; a driver-level fix in the PF path cannot be hot-patched. Until then, the exposure is bounded by who holds VFs - not assigning E810 VFs to untrusted guests removes the attack path without a reboot. No vendor advisory with fixed version strings is in the record.

References

Related entries

• Linux kernel (drivers/iommu/amd): Iommu_completion_wait() returned without waiting whenever another CPU had alreadyCVE-2026-68329 · Linux kernel (drivers/iommu/amd)High
• KVM s390 zPCI: IRQ registration without a summary bit stored a bogus guest AISB addressCVE-2026-68454 · Linux kernel KVM s390 zPCI (AIF registration without a summary bit)High
• Linux kernel BPF verifier: stale register bounds let an LSM-hook retval load bypass memory-safety checksCVE-2026-72111 · Linux kernel BPF verifier (check_mem_access retval range narrowing)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm): When KVM failed to program the interrupt remapping table for irq bypass, it left aCVE-2026-72283 · Linux kernel (arch/x86/kvm)High
• Linux kernel xen/pvcalls: malicious backend req_id drives an out-of-bounds write in the PV frontendCVE-2026-72380 · Linux kernel xen/pvcalls frontend (unbounded backend req_id indexing rsp[])High