CVE-2026-64113

Analyzed Analyzed - Analysis Complete

Use-After-Free in ixgbevf Linux Kernel Driver

Publication date: 2026-07-19

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-12

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64113

EUVD

EUVD-2026-45798

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 3.19 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ixgbevf driver. It occurs when the driver incorrectly handles skb (socket buffer) pointers during multicast source pruning. The bug allows a freed skb to be accessed in subsequent iterations of a loop, leading to memory corruption in NAPI softirq context.

Detection Guidance

This vulnerability is specific to the ixgbevf Linux kernel driver and requires static analysis or kernel debugging tools to detect. There are no direct network commands to detect it. Use static analysis tools like semgrep or scan_drop_continue_loops.py to scan kernel code for the use-after-free pattern. Kernel Address Sanitizer (KASAN) can also detect this issue during runtime if the vulnerable code path is triggered.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It affects systems using the ixgbevf driver for Intel 82599 virtual function network interfaces. Exploitation requires specific network conditions but could lead to denial of service or unauthorized access in vulnerable environments.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's ixgbevf driver, which could lead to memory corruption or crashes in NAPI softirq context. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel driver vulnerabilities.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. If using a vulnerable kernel version, upgrade to a patched version or disable the ixgbevf driver if not required. Monitor vendor advisories for updates to ixgbevf and apply them promptly. No temporary workarounds are suggested beyond disabling the driver.

Hi! I’m here to help you understand CVE-2026-64113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70