A high severity vulnerability in the Linux kernel ice driver allows a malicious virtual function to cause a kernel page fault and denial of service.

The vulnerability occurs in the ice_parser_profile_init function, which fails to validate the ptype value provided by a virtual function. This allows a low privileged attacker within a virtualized environment to trigger an out of bounds write, leading to a kernel page fault.

With a CVSS score of 8.8, this vulnerability poses a significant risk in multi tenant cloud environments. A compromised or malicious guest virtual machine can crash the host kernel, causing a denial of service for all other tenants sharing the same physical hardware.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or higher.

Proactive Monitoring: Monitor host system logs for unexpected kernel page faults or crashes associated with the ice network driver.

Compensating Controls: Restrict virtual function assignment to untrusted virtual machines until the host kernel is patched.

Public Exploit Available: No

Cloud service providers and administrators of virtualized infrastructure should treat this as a high priority update. Patching the host kernel is the only effective way to prevent malicious guest virtual machines from impacting host stability.