CVE-2026-64056
Received Received - Intake

Race Condition in Linux Kernel Cortina Ethernet Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead. Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped. Zero it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64056
EUVD
EUVD-2026-45629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the ethernet driver for Cortina hardware. A static local SKB (socket buffer) used to assemble packet fragments in the gmac_rx() function can cause issues when two ethernet ports are used simultaneously. The fix changes the SKB to be per-port to prevent races between ports.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethernet driver for Cortina hardware. Detection requires checking if your system uses the affected driver (gmac_rx) and kernel version. Inspect kernel logs for errors related to ethernet port races or SKB assembly failures.

Impact Analysis

If you use a system with the affected Linux kernel and have two ethernet ports active, this vulnerability could lead to packet corruption or data loss due to race conditions. It may cause network instability or crashes in extreme cases.

Compliance Impact

This vulnerability is a race condition in the Linux kernel's ethernet driver for the Cortina GMAC hardware, specifically affecting systems with dual ethernet ports. It does not directly relate to data privacy, security controls, or compliance requirements under standards like GDPR or HIPAA, as it pertains to network packet handling rather than data protection or access control.

Mitigation Strategies

Update your Linux kernel to a patched version that resolves this issue. Monitor kernel security advisories for updates to the Cortina ethernet driver. If using affected hardware, avoid dual-port configurations until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart