Linux Kernel CVE-2026-43346

Exploitation requires a highly specific VFIO passthrough configuration on Linux systems using Intel Ethernet Network Adapters with the ice driver. The vulnerable code path is reached only when a virtual machine is assigned a physical function (PF) that does not own the hardware PTP source timer, without also being assigned the controlling PF. This is a non-default configuration requiring deliberate SR-IOV setup and passthrough assignments by a system administrator. The attacker must have authenticated local access with sufficient privileges to provision or boot a VM with this specific passthrough configuration (typically requiring membership in kvm, libvirt, or similar groups). Standard Linux installations without VFIO passthrough enabled, systems not using Intel ice NICs, and properly configured SR-IOV deployments where controlling PFs are correctly assigned are not vulnerable. The vulnerability is further limited to systems running unpatched kernel versions 6.13 through 7.0-rc7 and does not affect default driver initialization paths.

Real-world risk is LOW despite the 5.5 CVSS base score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low complexity and low privileges required, but the impact is limited to availability (A:H) with no confidentiality or integrity impact. EPSS of 0.02% (4th percentile) suggests extremely low exploitation probability in the wild. No CISA KEV listing exists and no public exploit code has been identified. The vulnerability requires a highly specific deployment scenario: VFIO passthrough configuration where a non-controlling PF is assigned to a VM without the controlling PF, which is an edge case deployment pattern typically seen only in advanced virtualization setups. The impact is denial of service through system instability rather than complete system crash. SSVC framework assessment: exploitation status is NONE, automatable is NO (requires specific misconfiguration), technical impact is PARTIAL (availability only). Priority should be DEFER for most environments; SCHEDULED for organizations heavily using SR-IOV passthrough with Intel ice NICs in virtualized environments. The mismatch between moderate CVSS and very low EPSS reflects that this is a niche configuration issue rather than a broadly exploitable flaw.

An authenticated user with low-level privileges on a Linux system configured with VFIO passthrough provisions a virtual machine and assigns a physical function from an Intel ice network adapter that does not own the PTP source timer. When the VM boots and the ice driver attempts PTP initialization via ice_ptp_setup_pf(), the function calls ice_get_ctrl_ptp() which returns NULL due to the missing controlling PF. The vulnerable code triggers WARN_ON(), generating kernel log messages and potentially causing system instability or denial of service. No public proof-of-concept exists, but exploitation requires only local authenticated access to trigger the condition through standard VM provisioning operations.