CVE-2026-64113 - Vulnerability Details

- ixgbevf: fix use-after-free in VEPA multicast source pruning

Description

In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: fix use-after-free in VEPA multicast source pruning

ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's
own address (VEPA multicast workaround) by freeing the skb and
continuing to the next descriptor:

dev_kfree_skb_irq(skb);
continue;

The skb pointer is declared outside the while loop and persists across
iterations. Because the continue skips the "skb = NULL" reset at the
bottom of the loop, the next iteration enters the "else if (skb)" path
and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.

The sibling driver iavf already handles this correctly by nulling the
pointer before continuing. Apply the same pattern here.

I do not have ixgbevf hardware; the bug was found by static analysis
(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
corroboration with the highest score in the scan). The UAF was confirmed
under KASAN by loading a test module that reproduces the exact code
pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):

BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000
Read of size 8 at addr 000000006163ae78 by task insmod/30
freed 208-byte region [000000006163adc0, 000000006163ae90)

QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
driver does not include the VEPA source pruning path, so a full
end-to-end reproduction with emulated hardware was not possible.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ixgbevf driver contains a use‑after‑free bug caused by skipping a pointer reset after freeing. This flaw, classified as CWE‑825, can lead to arbitrary kernel memory corruption when memory is reused in a NAPI softirq context, potentially enabling privilege escalation.

Affected Systems

All Linux kernel releases that ship the buggy ixgbevf driver code for Intel 10/25Gb network adapters in virtualized environments are affected. The specific kernel versions are not listed in the CVE data.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity, yet the EPSS score of less than 1% suggests few active exploits at this time. Because the flaw occurs in a driver that processes external network traffic, the likely attack vector is remote network traffic directed at a vulnerable VM; this inference is based on the description that the vulnerability occurs in a driver handling network traffic. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< 3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< 6ef30384a50a50e4a484cddf341bc27de31aa3de
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< 55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< add70e2682c0ad3be2a5810bcf1bc13963ba4df9
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< a244395d8c563ed1bb26c3ef708db6aeeaa08084
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< dfef79e09ed2f5df975c98547f97f5d7f8982a24
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< e8768bcbe5cd30c4ea36a22022c9ffaa66903693
`bad17234ba702a50aeec50ab04724ee58af89607`	affected	< 5d49b568c188dc77199d8d2b959c91da8cc27cf1

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bad17234ba702a50aeec50ab04724ee58af89607,3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,6ef30384a50a50e4a484cddf341bc27de31aa3de)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,add70e2682c0ad3be2a5810bcf1bc13963ba4df9)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,a244395d8c563ed1bb26c3ef708db6aeeaa08084)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,dfef79e09ed2f5df975c98547f97f5d7f8982a24)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,e8768bcbe5cd30c4ea36a22022c9ffaa66903693)`	affected	code_commit	—
`[bad17234ba702a50aeec50ab04724ee58af89607,5d49b568c188dc77199d8d2b959c91da8cc27cf1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.19`	affected	generic	—
`[0,3.19)`	unaffected	generic	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ixgbevf patch that resets the skb pointer in the VEPA source‑pruning path.
If upgrading is not immediately possible, reconfigure the system to disable the VEPA multicast workaround or switch to a different NIC driver that does not implement the buggy logic.
Apply any available backport or vendor‑supplied patch that corrects the pointer reset (e.g., apply the specific commit from the kernel repository) and validate with KASAN or similar testing before deployment.

Generated by OpenCVE AI on July 30, 2026 at 20:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.005.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb
https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1
https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1
https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de
https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084
https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9
https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24
https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693
https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64113
https://www.cve.org/CVERecord?id=CVE-2026-64113

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64113-87d9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64113 https://www.cve.org/CVERecord?id=CVE-2026-64113
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
Title		ixgbevf: fix use-after-free in VEPA multicast source pruning
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1 https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1 https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084 https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9 https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24 https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:14.251Z

Updated: 2026-08-05T12:39:22.189Z

Reserved: 2026-07-19T07:54:57.035Z

Link: CVE-2026-64113

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64113 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object