{"id":"CVE-2026-68292","summary":"ice: prevent tstamp ring allocation for non-PF VSI types","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: prevent tstamp ring allocation for non-PF VSI types\n\nThe pf-\u003etxtime_txqs bitmap tracks which Tx queues have ETF (Earliest\nTxTime First) offload enabled. This bitmap is indexed by queue number\nand is set by ice_offload_txtime(), which only operates on PF VSI\nqueues.\n\nHowever, ice_is_txtime_ena() does not check the VSI type before\nconsulting the bitmap. When ETF offload is enabled on PF Tx queue 0,\nbit 0 is set in pf-\u003etxtime_txqs. During a subsequent PCI reset\nrebuild, the CTRL VSI's Tx queue 0 is reconfigured and\nice_is_txtime_ena() is called for that ring. Since it only checks\npf-\u003etxtime_txqs by queue index without distinguishing VSI type, it\nfinds bit 0 set and returns true, matching the PF VSI's ETF queue,\nnot the CTRL VSI's. This causes ice_vsi_cfg_txq() to spuriously\nallocate a tstamp_ring for the CTRL VSI ring.\n\nSince CTRL VSI rings have no associated netdev, ice_clean_tx_ring()\ntakes an early return at the !netdev check before reaching\nice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset\nleaks one 64-byte tstamp_ring.\n\nFix this by restricting ice_is_txtime_ena() to return true only for\nPF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.","modified":"2026-08-12T04:18:47.360218221Z","published":"2026-08-10T12:02:25.414Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68292.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/144539bbfd3cea1ab0fb6f5216d6004c1f4f029b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/684d4d0bda95a3fb21b3e29ff0f668f657707b54"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d0a21604c6abfa4956f3a511a1de174cec77a812"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68292.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68292"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ccde82e909467abdf098a8ee6f63e1ecf9a47ce5"},{"fixed":"684d4d0bda95a3fb21b3e29ff0f668f657707b54"},{"fixed":"d0a21604c6abfa4956f3a511a1de174cec77a812"},{"fixed":"144539bbfd3cea1ab0fb6f5216d6004c1f4f029b"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68292.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68292.json"}}],"schema_version":"1.9.0"}