CVE-2026-68292

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: prevent tstamp ring allocation for non-PF VSI types<br /> <br /> The pf-&gt;txtime_txqs bitmap tracks which Tx queues have ETF (Earliest<br /> TxTime First) offload enabled. This bitmap is indexed by queue number<br /> and is set by ice_offload_txtime(), which only operates on PF VSI<br /> queues.<br /> <br /> However, ice_is_txtime_ena() does not check the VSI type before<br /> consulting the bitmap. When ETF offload is enabled on PF Tx queue 0,<br /> bit 0 is set in pf-&gt;txtime_txqs. During a subsequent PCI reset<br /> rebuild, the CTRL VSI&amp;#39;s Tx queue 0 is reconfigured and<br /> ice_is_txtime_ena() is called for that ring. Since it only checks<br /> pf-&gt;txtime_txqs by queue index without distinguishing VSI type, it<br /> finds bit 0 set and returns true, matching the PF VSI&amp;#39;s ETF queue,<br /> not the CTRL VSI&amp;#39;s. This causes ice_vsi_cfg_txq() to spuriously<br /> allocate a tstamp_ring for the CTRL VSI ring.<br /> <br /> Since CTRL VSI rings have no associated netdev, ice_clean_tx_ring()<br /> takes an early return at the !netdev check before reaching<br /> ice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset<br /> leaks one 64-byte tstamp_ring.<br /> <br /> Fix this by restricting ice_is_txtime_ena() to return true only for<br /> PF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.