CVE-2026-68128

The CVE describes an out-of-bounds write in the ice driver's handling of VIRTCHNL_OP_ADD_RSS_CFG messages. A malicious virtual function can send a ptype value >= 1024, which gets passed directly to set_bit against a 1024-bit bitmap, causing a kernel crash. The fix — rejecting out-of-range ptype with -EINVAL — is straightforward and has been merged. What matters most for prioritization: exploitation requires a compromised VM with a VF. The EPSS of 0.00138 reflects this prerequisite. However, don't let the low EPSG lull you into ignoring this. In shared-host cloud and containerized environments, getting a VM foothold is often the easier part of the attack — the lateral movement from VM to host kernel is the harder step this bug facilitates. A VF with direct access to the physical function is already past the trust boundary you rely on to isolate tenants. The deeper concern: this is one instance of a pattern. VIRTCHNL handlers across multiple drivers assume VF input is less adversarial than it actually is — a lesson the industry has relearned repeatedly since the virtio vulnerabilities of 2010. The ice driver likely has other VIRTCHNL message handlers with similar unchecked fields. You should audit ice and related drivers for bounds validation failures in all VIRTCHNL operations, not just the one that triggered this crash. Concrete actions: confirm your kernel version includes the ice driver fix (check for the ptype bounds check in ice_parser_profile_init or equivalent). If you run SR-IOV workloads, treat any compromised VM as a potential host compromise — this bug is a reminder that the VF-to-PF path was never a strong isolation boundary. Flag VIRTCHNL handler code for security review across your driver fleet.

Reviewed through automated stages and approved by a human before publication.