CVE-2026-68292

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: prevent tstamp ring allocation for non-PF VSI types

The pf->txtime_txqs bitmap tracks which Tx queues have ETF (Earliest

TxTime First) offload enabled. This bitmap is indexed by queue number

and is set by ice_offload_txtime(), which only operates on PF VSI

queues.

However, ice_is_txtime_ena() does not check the VSI type before

consulting the bitmap. When ETF offload is enabled on PF Tx queue 0,

bit 0 is set in pf->txtime_txqs. During a subsequent PCI reset

rebuild, the CTRL VSI's Tx queue 0 is reconfigured and

ice_is_txtime_ena() is called for that ring. Since it only checks

pf->txtime_txqs by queue index without distinguishing VSI type, it

finds bit 0 set and returns true, matching the PF VSI's ETF queue,

not the CTRL VSI's. This causes ice_vsi_cfg_txq() to spuriously

allocate a tstamp_ring for the CTRL VSI ring.

Since CTRL VSI rings have no associated netdev, ice_clean_tx_ring()

takes an early return at the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References