Linux Kernel EUVD-2026-55509

SR-IOV must be active on an Intel E810-series NIC with at least one Virtual Function assigned to a guest VM. The attacker must control that guest VM at root or module-loading privilege level - the crafted VIRTCHNL message is delivered via VIRTCHNL_OP_ADD_RSS_CFG, which requires the ability to issue VIRTCHNL ioctls from within the guest, typically available to the guest OS kernel or to a loaded kernel module. Non-E810 NICs, systems without SR-IOV enabled, and kernels not loading the ice module are not affected. The CVSS vector PR:L reflects that guest-OS-level root (low privilege relative to the host) is sufficient; no host-side credentials are required. User interaction on the host side is not required. The limiting factor is hardware specificity: only environments where untrusted parties can obtain E810 VF access - shared cloud, NFV, or bare-metal colocation with VF passthrough - are realistically at risk.

The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is technically justified - a successful exploit crosses from an unprivileged guest VM into the host kernel - but the aggregate real-world risk is meaningfully lower than that raw score implies. EPSS at 0.18% (7th percentile) reflects low observed exploitation activity, this CVE is absent from the CISA KEV catalog, and no public exploit code has been identified; the described reproduction required a custom kernel module. Exploitation is gated behind a specific SR-IOV configuration with at least one VF assigned to a potentially hostile guest, which limits the exposed population to cloud providers, NFV infrastructure, and shared colocation environments. The CVSS scope-change flag (S:C) is well-supported: a guest tenant can directly panic the host kernel, impacting all co-tenants - even a mid-sized hosting operator in gdynia managing shared E810 SR-IOV tenants should treat this as urgent given the trivial reproducibility and availability of stable-branch patches. The EPSS signal and the absence of KEV suggest opportunistic exploitation has not yet materialized, but the low attack complexity (AC:L) once a VF foothold exists means that window may close quickly after publication.

A tenant with root access inside a guest VM to which an Intel E810 VF is directly assigned loads a kernel module that sends a crafted VIRTCHNL_OP_ADD_RSS_CFG message containing ptype=0xffff. The host kernel's ice driver processes the message in ice_parser_profile_init without bounds-checking ptype, executes set_bit(0xffff, prof->ptypes), and writes to host kernel memory 64 bytes past the end of the 1024-bit bitmap. Depending on what occupies adjacent memory, this results in either an immediate kernel NULL pointer dereference that crashes the host (and all co-tenant VMs) or a memory corruption primitive that a sophisticated attacker could chain toward host privilege escalation.