{"advisories":[{"id":"USN-8575-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-1"},{"id":"USN-8576-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-1"},{"id":"USN-8593-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8593-1"},{"id":"USN-8575-2","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-2"},{"id":"USN-8576-2","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-2"},{"id":"USN-8575-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-3"},{"id":"USN-8603-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8603-1"},{"id":"USN-8610-1","source":"usn","title":"Linux kernel (Azure CVM) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8610-1"},{"id":"USN-8618-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8618-1"},{"id":"USN-8620-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-1"},{"id":"USN-8620-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-2"},{"id":"USN-8620-3","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-3"},{"id":"USN-8620-4","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-4"},{"id":"USN-8663-1","source":"usn","title":"Linux kernel (NVIDIA) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8663-1"},{"id":"USN-8664-1","source":"usn","title":"Linux kernel (NVIDIA BaseOS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8664-1"},{"id":"USN-8668-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-1"},{"id":"USN-8728-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-1"},{"id":"USN-8729-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-1"},{"id":"USN-8761-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-1"},{"id":"USN-8729-2","source":"usn","title":"Linux kernel (Raspberry Pi Real-time) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-2"},{"id":"USN-8761-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-2"},{"id":"USN-8781-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8781-1"},{"id":"USN-8668-2","source":"usn","title":"Linux kernel (Raspberry Pi) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-2"},{"id":"USN-8729-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-3"},{"id":"USN-8802-1","source":"usn","title":"Linux kernel (Oracle) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8802-1"},{"id":"USN-8728-2","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-2"},{"id":"USN-8729-4","source":"usn","title":"Linux kernel (Low Latency) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-4"},{"id":"USN-8729-5","source":"usn","title":"Linux kernel (AWS FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-5"}],"cve":"CVE-2026-64113","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,6ef30384a50a50e4a484cddf341bc27de31aa3de)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,add70e2682c0ad3be2a5810bcf1bc13963ba4df9)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,a244395d8c563ed1bb26c3ef708db6aeeaa08084)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,dfef79e09ed2f5df975c98547f97f5d7f8982a24)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,e8768bcbe5cd30c4ea36a22022c9ffaa66903693)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[bad17234ba702a50aeec50ab04724ee58af89607,5d49b568c188dc77199d8d2b959c91da8cc27cf1)"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"},{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"3.19"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[0,3.19)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.10.258,5.11.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.15.209,5.16.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.1.175,6.2.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.6.142,6.7.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.12.92,6.13.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.18.34,6.19.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.0.11,7.1.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[0,*]"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"}],"created":"2026-07-21T10:00:04.563372+00:00","updated":"2026-08-13T12:45:03.413380+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"]},"epss":{"score":0.00527},"mitre":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"created":"2026-07-19T15:40:14.251000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n    dev_kfree_skb_irq(skb);\n    continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations.  Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing.  Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan).  The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n  BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n  Read of size 8 at addr 000000006163ae78 by task insmod/30\n  freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/64xxx/CVE-2026-64113.json","references":["https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb","https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1","https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1","https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de","https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084","https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9","https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24","https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693"],"title":"ixgbevf: fix use-after-free in VEPA multicast source pruning","updated":"2026-08-05T12:39:22.189000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"created":"2026-07-19T16:17:52.680000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n    dev_kfree_skb_irq(skb);\n    continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations.  Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing.  Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan).  The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n  BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n  Read of size 8 at addr 000000006163ae78 by task insmod/30\n  freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-64113.json","references":["https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb","https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1","https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1","https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de","https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084","https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9","https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24","https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693"],"title":null,"updated":"2026-08-12T15:50:27.320000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":["CWE-416"]},"opencve":{"changes":[{"created":"2026-07-19T16:15:00+00:00","data":[{"details":{"new":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n    dev_kfree_skb_irq(skb);\n    continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations.  Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing.  Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan).  The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n  BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n  Read of size 8 at addr 000000006163ae78 by task insmod/30\n  freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.","old":null},"type":"description"},{"details":{"new":"ixgbevf: fix use-after-free in VEPA multicast source pruning","old":null},"type":"title"},{"details":["linux","linux$PRODUCT$linux_kernel"],"type":"first_time"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["linux","linux$PRODUCT$linux_kernel"],"removed":[]},"type":"vendors"},{"details":{"added":["https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb","https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1","https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1","https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de","https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084","https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9","https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24","https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693"],"removed":[]},"type":"references"}],"id":"671863d0-9c85-40b7-984e-7e69a9389739"},{"created":"2026-07-20T14:45:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"b031742c-2511-4b16-a047-1f83f4c0cf5a"},{"created":"2026-07-21T00:15:00+00:00","data":[{"details":{"added":["CWE-825"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64113","https://www.cve.org/CVERecord?id=CVE-2026-64113"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Important","old":null}}},"type":"metrics"}],"id":"c3eb6d8c-02ba-4f9e-a1d5-2f4c25785d64"},{"created":"2026-08-12T16:00:00+00:00","data":[{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"11b9786b-4f68-4053-84bb-ee4012a3607e"}],"cpes":{"data":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-07-19T00:00:00+00:00","provider":"redhat"},"description":{"data":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n    dev_kfree_skb_irq(skb);\n    continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations.  Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing.  Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan).  The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n  BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n  Read of size 8 at addr 000000006163ae78 by task insmod/30\n  freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00527},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":"Important","provider":"redhat"}},"references":{"data":["https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb","https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1","https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1","https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de","https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084","https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9","https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24","https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693","https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64113","https://www.cve.org/CVERecord?id=CVE-2026-64113"],"providers":["mitre","nvd","redhat"]},"title":{"data":"ixgbevf: fix use-after-free in VEPA multicast source pruning","provider":"mitre"},"updated":{"data":"2026-08-12T15:50:27.320000+00:00","provider":"nvd"},"vendors":{"data":["linux","linux$PRODUCT$linux_kernel"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-416","CWE-825"],"providers":["nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-07-19T00:00:00+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\nixgbevf: fix use-after-free in VEPA multicast source pruning\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\ndev_kfree_skb_irq(skb);\ncontinue;\nThe skb pointer is declared outside the while loop and persists across\niterations.  Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing.  Apply the same pattern here.\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan).  The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\nBUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\nRead of size 8 at addr 000000006163ae78 by task insmod/30\nfreed 208-byte region [000000006163adc0, 000000006163ae90)\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.0,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"threat_severity":"Important"},"redhat_repo_path":"2026/CVE-2026-64113.json","references":["https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64113","https://www.cve.org/CVERecord?id=CVE-2026-64113"],"title":"kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning","updated":"2026-07-19T00:00:00+00:00","vendors":[],"weaknesses":["CWE-825"]}}