CVE-2026-64055: Linux Kernel Privilege Escalation Flaw

CVE-2026-64055 Overview

CVE-2026-64055 is a Linux kernel vulnerability in the Cortina Gemini gmac Ethernet driver. The flaw lives in the gmac_rx() NAPI poll function, which assembles received packets into an SKB from a hardware ring buffer. When the ring buffer empties mid-assembly, the poll routine exits with a partially built packet, but the fragment counter frag_nr is reset to zero on the next invocation. This desynchronization between the driver's tracked fragment state and the actual SKB contents produces malformed packet handling on Cortina Gemini Ethernet interfaces. The upstream fix carries the fragment counter across NAPI poll invocations by moving it into the port structure.

Critical Impact
Network-adjacent traffic reaching a Cortina gmac interface can drive the receive path into an inconsistent SKB assembly state, enabling packet corruption and potential kernel memory safety issues on affected devices.

Affected Products

Linux kernel builds including the Cortina Gemini net/ethernet/cortina gmac driver
Embedded and SoC platforms shipping the Cortina Gemini network controller
Downstream distributions and stable trees prior to the referenced backport commits

Discovery Timeline

2026-07-19 - CVE-2026-64055 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64055

Vulnerability Analysis

The gmac_rx() function in the Cortina Ethernet driver processes received frames using NAPI polling. Frames arrive as fragments in a hardware ring buffer, and the driver assembles them into a single SKB before handing off to the network stack via napi_gro_frags(). A local fragment counter frag_nr tracks the number of fragments consumed for the in-progress SKB.

When the ring buffer runs dry during a poll cycle, gmac_rx() returns without completing the current SKB. On the next invocation, the driver reinitializes frag_nr to zero, even though prior fragments remain attached to the partially assembled SKB. Subsequent fragment accounting therefore diverges from the actual SKB state, producing malformed packet delivery and possible memory misuse in the receive path.

Root Cause

The root cause is scope and lifetime mismatch. The fragment counter was maintained as function-local state, but the SKB it accounts for persists across NAPI poll invocations. The corrective patch relocates the counter into the port struct so it survives between gmac_rx() calls. The counter is now reset only after successful delivery via napi_gro_frags(), on error paths after napi_free_frags(), or when the port is stopped.

Attack Vector

Exploitation requires the target to receive network traffic on a Cortina gmac interface. An attacker able to send crafted frames that trigger ring-buffer exhaustion mid-frame can force the counter reset condition. Because the receive path runs in kernel softirq context, mishandled fragment accounting can produce invalid SKB shinfo state, corrupt frame delivery to upper layers, or induce kernel instability. No authentication or user interaction is required.

No public proof-of-concept exploit is available. Verified technical details are documented in the upstream kernel commits, including Kernel Commit 46806096 and Kernel Commit ebd8ec2b.

Detection Methods for CVE-2026-64055

Indicators of Compromise

Unexplained kernel warnings or oops messages referencing gmac_rx, napi_gro_frags, or skb_shinfo on Cortina Gemini platforms
Network interface counter anomalies showing dropped or malformed frames on gmac interfaces without a matching cause on the wire
Sporadic RX stalls or NAPI reschedule storms that correlate with heavy or bursty inbound traffic

Detection Strategies

Inventory kernel builds and confirm whether the Cortina gmac driver is compiled and bound to an active interface using ethtool -i <iface>
Compare running kernel commit against the fix commits listed in the NVD advisory to identify unpatched systems
Enable netdev and napi tracepoints during controlled traffic replay to observe fragment counter behavior across poll cycles

Monitoring Recommendations

Forward kernel dmesg and netdev telemetry to a centralized log platform and alert on RX-path warnings tied to the gmac driver
Track per-interface RX error, drop, and fifo counters via ip -s link and Prometheus node exporters for baseline deviations
Watch for elevated softirq CPU usage on cores handling Cortina NIC interrupts as an early signal of RX path pathology

How to Mitigate CVE-2026-64055

Immediate Actions Required

Apply the upstream stable kernel updates that include the fragment counter carryover fix for the Cortina gmac driver
On embedded devices, coordinate with the platform vendor to obtain firmware or kernel images incorporating the referenced commits
Restrict exposure of affected devices to untrusted network segments until patching is complete

Patch Information

The fix moves frag_nr into the port struct and resets it only after napi_gro_frags(), after napi_free_frags() on error, or on port stop. Backports are available across stable trees. Refer to Kernel Commit 7123cf48, Kernel Commit 75105fcf, Kernel Commit 78cf08b3, Kernel Commit 7af1fabd, Kernel Commit c373b348, and Kernel Commit df31e3b6 for the specific backport applicable to your kernel branch.

Workarounds

Place affected devices behind an upstream L2/L3 filter that drops malformed or fragmented traffic patterns known to trigger ring exhaustion
Where operationally possible, disable the Cortina gmac interface and route traffic through an unaffected NIC until patched
Reduce NAPI weight or RX ring size only as a temporary measure; note this does not eliminate the underlying counter desynchronization

bash

# Verify running kernel and Cortina gmac driver status
uname -r
ethtool -i eth0 | grep -E 'driver|version'

# Confirm the fix is present by checking the port struct for frag_nr
# (requires kernel source matching the running build)
grep -n 'frag_nr' drivers/net/ethernet/cortina/gemini.c

# Apply distribution kernel update, then reboot
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r)
sudo reboot