CVE-2026-68133 - Vulnerability Details

- ice: fix PTP Call Trace during PTP release

Description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix PTP Call Trace during PTP release

If a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then
ice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will
result in the following PTP release call trace during driver unload:

kernel BUG at lib/list_debug.c:52!
ice_ptp_release+0x332/0x3c0 [ice]
ice_deinit_features.part.0+0x10e/0x120 [ice]
ice_remove+0x100/0x220 [ice]

This was observed when passing PF1 through to a VM. ice_ptp_init()
fails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT.

Fix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and
returning without error, preventing the invalid state transition to
ICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from
ICE_PTP_RESETTING after a failed rebuild.

Published: 2026-08-10

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

During a PF reset when the PTP state is ICE_PTP_UNINIT, the ice driver’s ice_ptp_rebuild() incorrectly changes the state to ICE_PTP_ERROR, which leads to a kernel BUG at lib/list_debug.c:52 during driver unload. This BUG can crash the kernel, resulting in a service disruption on the host. The weakness is a misuse of internal state transitions that fails to guard against an uninitialized state.

Affected Systems

All Linux distributions that ship the Linux kernel with the ice network driver before the fix is applied are affected. The vulnerability is present in any kernel version containing the buggy ice driver logic, regardless of vendor, as the CPE indicates "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*".

Risk and Exploitability

The CVSS score is 5.5, indicating a medium severity, while the EPSS score is less than 1%, showing low exploitation probability. The vulnerability is not listed in CISA KEV. The lack of publicly reported exploits suggests low to medium exploitability, but the impact of a kernel crash is high. An attacker with local or privileged access who can trigger a PF reset or pass through a PF to a virtual machine is likely able to trigger the BUG. Because the kernel panics, the vulnerability can be used for denial of service but does not appear to allow remote code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8`	affected	< 7d517b255f669cedd09830214d55f2f413b34481
`8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8`	affected	< e4406cbdd915f702d2ed9ee8b30683a16b06c6ac
`8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8`	affected	< 14fceda28069fdbe1bb49cdb6e1774892b583348
`8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8`	affected	< f6a7e00b81e35ef1325234925f2fe1e53b466f92

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8,7d517b255f669cedd09830214d55f2f413b34481)`	affected	code_commit	—
`[8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8,e4406cbdd915f702d2ed9ee8b30683a16b06c6ac)`	affected	code_commit	—
`[8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8,14fceda28069fdbe1bb49cdb6e1774892b583348)`	affected	code_commit	—
`[8293e4cb2ff54b1ec4f7206dcb74c908f62a3fb8,f6a7e00b81e35ef1325234925f2fe1e53b466f92)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ice driver patch that checks for ICE_PTP_UNINIT in ice_ptp_rebuild() (commit 14fceda28069).
Disable PTP functionality on the ice interface, for example by loading the driver with the module parameter 'ptp=off' or using sysfs to disable PTP, until the kernel can be updated.
Continuously monitor kernel logs for the occurrence of BUG messages at lib/list_debug.c:52 and investigate promptly if they recur.

Generated by OpenCVE AI on August 13, 2026 at 07:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/14fceda28069fdbe1bb49cdb6e1774892b583348
https://git.kernel.org/stable/c/7d517b255f669cedd09830214d55f2f413b34481
https://git.kernel.org/stable/c/e4406cbdd915f702d2ed9ee8b30683a16b06c6ac
https://git.kernel.org/stable/c/f6a7e00b81e35ef1325234925f2fe1e53b466f92
https://lore.kernel.org/linux-cve-announce/2026081058-CVE-2026-68133-2a7c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68133
https://www.cve.org/CVERecord?id=CVE-2026-68133

History

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://lore.kernel.org/linux-cve-announce/2026081058-CVE-2026-68133-2a7c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68133 https://www.cve.org/CVERecord?id=CVE-2026-68133
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Mon, 10 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then ice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will result in the following PTP release call trace during driver unload: kernel BUG at lib/list_debug.c:52! ice_ptp_release+0x332/0x3c0 [ice] ice_deinit_features.part.0+0x10e/0x120 [ice] ice_remove+0x100/0x220 [ice] This was observed when passing PF1 through to a VM. ice_ptp_init() fails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT. Fix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and returning without error, preventing the invalid state transition to ICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from ICE_PTP_RESETTING after a failed rebuild.
Title		ice: fix PTP Call Trace during PTP release
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/14fceda28069fdbe1bb49cdb6e1774892b583348 https://git.kernel.org/stable/c/7d517b255f669cedd09830214d55f2f413b34481 https://git.kernel.org/stable/c/e4406cbdd915f702d2ed9ee8b30683a16b06c6ac https://git.kernel.org/stable/c/f6a7e00b81e35ef1325234925f2fe1e53b466f92

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:56.223Z

Updated: 2026-08-17T04:59:25.287Z

Reserved: 2026-07-30T09:28:09.370Z

Link: CVE-2026-68133

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:58.760

Modified: 2026-08-17T05:18:13.133

Link: CVE-2026-68133

Redhat

Severity : Low

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68133 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:30:06Z

Weaknesses

CWE-617
Reachable Assertion
CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object