CVE-2026-68292: ice: prevent tstamp ring allocation for non-PF VSI types

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ice: prevent tstamp ring allocation for non-PF VSI types

The pf->txtime_txqs bitmap tracks which Tx queues have ETF (Earliest
TxTime First) offload enabled. This bitmap is indexed by queue number
and is set by ice_offload_txtime(), which only operates on PF VSI
queues.

However, ice_is_txtime_ena() does not check the VSI type before
consulting the bitmap. When ETF offload is enabled on PF Tx queue 0,
bit 0 is set in pf->txtime_txqs. During a subsequent PCI reset
rebuild, the CTRL VSI's Tx queue 0 is reconfigured and
ice_is_txtime_ena() is called for that ring. Since it only checks
pf->txtime_txqs by queue index without distinguishing VSI type, it
finds bit 0 set and returns true, matching the PF VSI's ETF queue,
not the CTRL VSI's. This causes ice_vsi_cfg_txq() to spuriously
allocate a tstamp_ring for the CTRL VSI ring.

Since CTRL VSI rings have no associated netdev, ice_clean_tx_ring()
takes an early return at the !netdev check before reaching
ice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset
leaks one 64-byte tstamp_ring.

Fix this by restricting ice_is_txtime_ena() to return true only for
PF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.

The Linux kernel CVE team has assigned CVE-2026-68292 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.18 with commit ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 and fixed in 6.18.42 with commit 684d4d0bda95a3fb21b3e29ff0f668f657707b54
	Issue introduced in 6.18 with commit ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 and fixed in 7.1.6 with commit d0a21604c6abfa4956f3a511a1de174cec77a812
	Issue introduced in 6.18 with commit ccde82e909467abdf098a8ee6f63e1ecf9a47ce5 and fixed in 7.2-rc5 with commit 144539bbfd3cea1ab0fb6f5216d6004c1f4f029b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68292
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/intel/ice/ice.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/684d4d0bda95a3fb21b3e29ff0f668f657707b54
	https://git.kernel.org/stable/c/d0a21604c6abfa4956f3a511a1de174cec77a812
	https://git.kernel.org/stable/c/144539bbfd3cea1ab0fb6f5216d6004c1f4f029b