{ "advisories": [ { "id": "USN-8575-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-1" }, { "id": "USN-8576-1", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8576-1" }, { "id": "USN-8593-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8593-1" }, { "id": "USN-8575-2", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-2" }, { "id": "USN-8576-2", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8576-2" }, { "id": "USN-8575-3", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-3" }, { "id": "USN-8603-1", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8603-1" }, { "id": "USN-8610-1", "source": "usn", "title": "Linux kernel (Azure CVM) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8610-1" }, { "id": "USN-8618-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8618-1" }, { "id": "USN-8620-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-1" }, { "id": "USN-8620-2", "source": "usn", "title": "Linux kernel (Azure FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-2" }, { "id": "USN-8620-3", "source": "usn", "title": "Linux kernel (Intel IoTG) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-3" }, { "id": "USN-8620-4", "source": "usn", "title": "Linux kernel (Intel IoTG) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-4" }, { "id": "USN-8663-1", "source": "usn", "title": "Linux kernel (NVIDIA) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8663-1" }, { "id": "USN-8664-1", "source": "usn", "title": "Linux kernel (NVIDIA BaseOS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8664-1" }, { "id": "USN-8668-1", "source": "usn", "title": "Linux kernel (GCP) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8668-1" }, { "id": "USN-8728-1", "source": "usn", "title": "Linux kernel (GCP) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8728-1" }, { "id": "USN-8729-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-1" }, { "id": "USN-8761-1", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8761-1" }, { "id": "USN-8729-2", "source": "usn", "title": "Linux kernel (Raspberry Pi Real-time) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-2" }, { "id": "USN-8761-2", "source": "usn", "title": "Linux kernel (Azure FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8761-2" }, { "id": "USN-8781-1", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8781-1" }, { "id": "USN-8668-2", "source": "usn", "title": "Linux kernel (Raspberry Pi) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8668-2" }, { "id": "USN-8729-3", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-3" }, { "id": "USN-8802-1", "source": "usn", "title": "Linux kernel (Oracle) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8802-1" }, { "id": "USN-8728-2", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8728-2" }, { "id": "USN-8729-4", "source": "usn", "title": "Linux kernel (Low Latency) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-4" }, { "id": "USN-8729-5", "source": "usn", "title": "Linux kernel (AWS FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-5" } ], "cve": "CVE-2026-64113", "enrichment": { "affected": [ { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,6ef30384a50a50e4a484cddf341bc27de31aa3de)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,add70e2682c0ad3be2a5810bcf1bc13963ba4df9)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,a244395d8c563ed1bb26c3ef708db6aeeaa08084)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,dfef79e09ed2f5df975c98547f97f5d7f8982a24)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,e8768bcbe5cd30c4ea36a22022c9ffaa66903693)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[bad17234ba702a50aeec50ab04724ee58af89607,5d49b568c188dc77199d8d2b959c91da8cc27cf1)" } } ], "enrichment": { "confidence": 99.0, "confidence_source": "inferred", "scores": [ { "score": 99.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Linux", "source": "cna", "vendor": "Linux" }, "product": "linux_kernel", "vendor": "linux" }, { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "generic", "value": "3.19" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "generic", "value": "[0,3.19)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[5.10.258,5.11.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[5.15.209,5.16.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.1.175,6.2.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.6.142,6.7.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.12.92,6.13.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.18.34,6.19.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[7.0.11,7.1.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "generic", "value": "[0,*]" } } ], "enrichment": { "confidence": 99.0, "confidence_source": "inferred", "scores": [ { "score": 99.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Linux", "source": "cna", "vendor": "Linux" }, "product": "linux_kernel", "vendor": "linux" } ], "created": "2026-07-21T10:00:04.563372+00:00", "updated": "2026-08-13T12:45:03.413380+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ] }, "epss": { "score": 0.00527 }, "mitre": { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "created": "2026-07-19T15:40:14.251000+00:00", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "cvssV4_0": {} }, "mitre_repo_path": "cves/2026/64xxx/CVE-2026-64113.json", "references": [ "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693" ], "title": "ixgbevf: fix use-after-free in VEPA multicast source pruning", "updated": "2026-08-05T12:39:22.189000+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ], "weaknesses": [] }, "nvd": { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "created": "2026-07-19T16:17:52.680000+00:00", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "cvssV4_0": {} }, "nvd_repo_path": "2026/CVE-2026-64113.json", "references": [ "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693" ], "title": null, "updated": "2026-08-12T15:50:27.320000+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ], "weaknesses": [ "CWE-416" ] }, "opencve": { "changes": [ { "created": "2026-07-19T16:15:00+00:00", "data": [ { "details": { "new": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "old": null }, "type": "description" }, { "details": { "new": "ixgbevf: fix use-after-free in VEPA multicast source pruning", "old": null }, "type": "title" }, { "details": [ "linux", "linux$PRODUCT$linux_kernel" ], "type": "first_time" }, { "details": { "added": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" }, { "details": { "added": [ "linux", "linux$PRODUCT$linux_kernel" ], "removed": [] }, "type": "vendors" }, { "details": { "added": [ "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693" ], "removed": [] }, "type": "references" } ], "id": "671863d0-9c85-40b7-984e-7e69a9389739" }, { "created": "2026-07-20T14:45:00+00:00", "data": [ { "details": { "added": { "cvssV3_1": { "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "b031742c-2511-4b16-a047-1f83f4c0cf5a" }, { "created": "2026-07-21T00:15:00+00:00", "data": [ { "details": { "added": [ "CWE-825" ], "removed": [] }, "type": "weaknesses" }, { "details": { "added": [ "https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64113", "https://www.cve.org/CVERecord?id=CVE-2026-64113" ], "removed": [] }, "type": "references" }, { "details": { "added": {}, "removed": {}, "updated": { "threat_severity": { "new": "Important", "old": null } } }, "type": "metrics" } ], "id": "c3eb6d8c-02ba-4f9e-a1d5-2f4c25785d64" }, { "created": "2026-08-12T16:00:00+00:00", "data": [ { "details": { "added": [ "CWE-416" ], "removed": [] }, "type": "weaknesses" }, { "details": { "added": [ "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" } ], "id": "11b9786b-4f68-4053-84bb-ee4012a3607e" } ], "cpes": { "data": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "providers": [ "mitre", "nvd" ] }, "created": { "data": "2026-07-19T00:00:00+00:00", "provider": "redhat" }, "description": { "data": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "provider": "mitre" }, "metrics": { "cvssV2_0": { "data": {}, "provider": null }, "cvssV3_0": { "data": {}, "provider": null }, "cvssV3_1": { "data": { "score": 9.8, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "provider": "mitre" }, "cvssV4_0": { "data": {}, "provider": null }, "epss": { "data": { "score": 0.00527 }, "provider": "first" }, "kev": { "data": {}, "provider": null }, "ssvc": { "data": {}, "provider": null }, "threat_severity": { "data": "Important", "provider": "redhat" } }, "references": { "data": [ "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693", "https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64113", "https://www.cve.org/CVERecord?id=CVE-2026-64113" ], "providers": [ "mitre", "nvd", "redhat" ] }, "title": { "data": "ixgbevf: fix use-after-free in VEPA multicast source pruning", "provider": "mitre" }, "updated": { "data": "2026-08-12T15:50:27.320000+00:00", "provider": "nvd" }, "vendors": { "data": [ "linux", "linux$PRODUCT$linux_kernel" ], "providers": [ "mitre", "nvd", "enrichment" ] }, "weaknesses": { "data": [ "CWE-416", "CWE-825" ], "providers": [ "nvd", "redhat" ] } }, "redhat": { "cpes": [], "created": "2026-07-19T00:00:00+00:00", "description": "In the Linux kernel, the following vulnerability has been resolved:\nixgbevf: fix use-after-free in VEPA multicast source pruning\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\ndev_kfree_skb_irq(skb);\ncontinue;\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):\nBUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\nRead of size 8 at addr 000000006163ae78 by task insmod/30\nfreed 208-byte region [000000006163adc0, 000000006163ae90)\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible.", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.0, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "threat_severity": "Important" }, "redhat_repo_path": "2026/CVE-2026-64113.json", "references": [ "https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64113", "https://www.cve.org/CVERecord?id=CVE-2026-64113" ], "title": "kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning", "updated": "2026-07-19T00:00:00+00:00", "vendors": [], "weaknesses": [ "CWE-825" ] } }