CVE-2026-64035: Linux Kernel Privilege Escalation Flaw

CVE-2026-64035 Overview

CVE-2026-64035 is a Linux kernel vulnerability in the igc Intel 2.5G Ethernet driver. The flaw resides in igc_fpe_init_smd_frame(), which initializes igc_tx_buffer fields for a Signal Message Delimiter (SMD) skb but fails to set the buffer type. Because igc_tx_buffer entries are reused across transmissions, a stale XDP or AF_XDP (XSK) buffer type can persist. Transmit completion logic then selects the wrong cleanup path, leading to incorrect memory handling in the driver's TX path. The fix explicitly sets the buffer type to IGC_TX_BUFFER_TYPE_SKB before use.

Critical Impact
Stale TX buffer type metadata can cause the igc driver to invoke incorrect cleanup routines during transmit completion, resulting in kernel memory corruption on systems using Frame Preemption (FPE) with SMD frames.

Affected Products

Linux kernel versions containing the igc driver with Frame Preemption support
Systems using Intel I225/I226 2.5 Gigabit Ethernet controllers with FPE enabled
Distributions shipping kernels prior to the referenced stable fixes

Discovery Timeline

2026-07-19 - CVE-2026-64035 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64035

Vulnerability Analysis

The igc driver supports IEEE 802.1Qbu Frame Preemption, which uses Signal Message Delimiter (SMD) frames to mark preemptible traffic boundaries. The function igc_fpe_init_smd_frame() prepares an SMD skb and populates fields inside an igc_tx_buffer descriptor entry. However, the original implementation omits setting the type field on that buffer.

Because the TX ring reuses igc_tx_buffer slots, whatever type was previously stored, such as IGC_TX_BUFFER_TYPE_XDP or IGC_TX_BUFFER_TYPE_XSK, remains in place. When the hardware signals transmit completion, the driver dispatches cleanup based on this stale type. XDP and XSK cleanup paths free memory and update ring state in ways incompatible with an SKB-backed buffer.

Root Cause

The root cause is missing initialization of a discriminant field in a reused data structure. The igc_tx_buffer.type field acts as a tagged-union selector for TX completion handling. Failing to assign it before submission leaves the union tag inconsistent with the underlying payload, which qualifies as an uninitialized memory use condition and a type confusion in the completion path.

Attack Vector

Triggering the bug requires the igc driver to alternate between XDP or AF_XDP transmit workloads and Frame Preemption SMD frame emission on the same TX queue. In such mixed workloads the completion handler dereferences buffer metadata under the wrong type, which may free pages that belong to XDP pools or invoke XSK descriptor recycling against an SKB payload. This can corrupt kernel memory structures.

No public exploit or proof of concept has been published. Full technical detail is available in the upstream stable commits 1c8587bd, 1f83545f, and 5acc641e.

Detection Methods for CVE-2026-64035

Indicators of Compromise

Kernel oops or panic traces referencing igc_clean_tx_irq, igc_unmap_tx_buffer, or XDP/XSK cleanup helpers on hosts using Intel I225/I226 NICs
Unexpected page pool accounting warnings (page_pool_release) tied to the igc driver
Sporadic TX stalls or ring resets on interfaces with Frame Preemption enabled through tc or ethtool

Detection Strategies

Inventory hosts running kernel builds that include igc FPE support and confirm patch level against the referenced stable commits
Correlate kernel log entries for igc TX cleanup faults with active XDP or AF_XDP workloads on the same interface
Monitor for repeated NIC resets on 2.5GbE interfaces used in time-sensitive networking (TSN) deployments

Monitoring Recommendations

Enable dmesg and journald forwarding for kernel subsystems to a centralized log platform for cross-host correlation
Track ethtool -S <iface> counters for TX errors, dropped frames, and reset events on igc-managed interfaces
Alert on kernel taint transitions and driver-reported hardware errors from hosts running mixed XDP and FPE configurations

How to Mitigate CVE-2026-64035

Immediate Actions Required

Apply the upstream igc fix from stable commits 1c8587bd, 1f83545f, and 5acc641e
Update to a distribution kernel that incorporates these stable backports
Audit TSN and Frame Preemption deployments to identify exposed I225/I226 hosts

Patch Information

The fix explicitly assigns IGC_TX_BUFFER_TYPE_SKB to the type field of the igc_tx_buffer entry inside igc_fpe_init_smd_frame(). This ensures TX completion routes SMD frames through the SKB cleanup path rather than an inherited XDP or XSK path. The change is included in the referenced stable kernel commits and is available through mainline Linux stable releases.

Workarounds

Disable Frame Preemption via ethtool --set-mm <iface> pmac-enabled off tx-enabled off where FPE is not required
Avoid mixing XDP or AF_XDP sockets with Frame Preemption on the same igc TX queue until patched kernels are deployed
Restrict administrative access to network configuration to prevent unprivileged users from enabling FPE on affected interfaces

bash

# Verify running kernel and igc module details
uname -r
modinfo igc | grep -E 'version|srcversion'

# Check whether Frame Preemption is currently active on an interface
ethtool --show-mm eth0

# Temporarily disable Frame Preemption on an unpatched host
ethtool --set-mm eth0 pmac-enabled off tx-enabled off