CVE-2026-64056: Linux Kernel Race Condition Vulnerability

CVE-2026-64056 Overview

CVE-2026-64056 is a race condition in the Linux kernel's Cortina Gemini ethernet driver (net: ethernet: cortina). The gmac_rx() function used a static local socket buffer (SKB) to assemble packets from fragments. Because the Gemini SoC exposes two ethernet ports that share this driver, both ports could concurrently access the same static SKB when a device used both interfaces. The upstream fix moves the RX SKB into the per-port structure and clears the pointer after napi_gro_frags(), after an error path calling napi_free_frags(), and when a port is stopped.

Critical Impact
Concurrent traffic on both Gemini ethernet ports can corrupt shared receive state in the kernel network stack, producing undefined packet processing behavior.

Affected Products

Linux kernel builds including the cortina Gemini GMAC ethernet driver
Cortina Systems Gemini SoC platforms using both ethernet ports
Downstream distributions shipping the affected drivers/net/ethernet/cortina/gemini.c code prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-64056 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64056

Vulnerability Analysis

The Cortina Gemini GMAC driver reassembles fragmented receive descriptors into a single SKB before handing it to the network stack. The original implementation declared this staging SKB as a static local variable inside gmac_rx(). A static local is a single storage location shared across all callers of the function. On the Gemini SoC, gmac_rx() runs for each of the two independent GMAC ports, so simultaneous NAPI polling on both ports operates on the same SKB pointer. This creates a race on the packet assembly state.

When a device actively uses both ports, one port can overwrite or free fragments the other port is still processing. The commit message credits the issue to reviewer Sashiko, who identified the sharing during patch review.

Root Cause

The root cause is unsafe global state in a per-instance data path. A static local SKB pointer was treated as if the function had a single caller, but the Gemini driver instantiates one net_device per port and both call into the same receive function under their own NAPI contexts. There is no locking around the SKB pointer, so any interleaving between the two ports' receive paths corrupts fragment reassembly.

Attack Vector

Exploitation requires network traffic arriving concurrently on both Gemini ethernet ports of an affected device. The interaction is triggered by ordinary receive processing and does not require authenticated access to the host. Observed outcomes include use-after-free style corruption of sk_buff fragments, kernel memory disclosure through mis-assembled packets, and potential denial of service through kernel oops. Because the flaw sits in the RX fast path of a network driver, remote attackers on adjacent networks can influence the timing by directing traffic simultaneously at both ports.

No verified proof-of-concept code is published. The fix is available in the upstream stable tree via commits 06937db, 27856d5, 3b24998, 67a35e7, 6bba24e, 72158ea, b6b22824, and cfd62907. See the Linux Kernel Commit 06937db for the primary change moving the SKB into the port structure.

Detection Methods for CVE-2026-64056

Indicators of Compromise

Kernel warnings or oops messages referencing gmac_rx, napi_gro_frags, or napi_free_frags on Gemini-based hardware
Unexpected SKB fragment accounting errors in dmesg when both eth0 and eth1 are active on a Gemini SoC
Packet corruption, checksum failures, or truncated frames appearing only when both ports carry concurrent traffic

Detection Strategies

Enumerate running kernels on Cortina Gemini hardware and compare against the fixed commit hashes listed in the NVD references
Monitor ethtool -S counters on both ports for anomalous rx_fragment or dropped-frame growth during dual-port workloads
Enable CONFIG_DEBUG_KMEMLEAK and KASAN on test builds to surface racing accesses to the shared SKB during dual-port stress tests

Monitoring Recommendations

Forward kernel logs from Gemini-based appliances to a central log store and alert on gemini or gmac driver stack traces
Track NAPI poll latency and error counters per port to catch degradation from the race before it produces a crash
Baseline packet loss on each interface individually versus both interfaces under load to identify contention symptoms

How to Mitigate CVE-2026-64056

Immediate Actions Required

Update to a Linux stable kernel that includes one of the fix commits (06937db, 27856d5, 3b24998, 67a35e7, 6bba24e, 72158ea, b6b22824, cfd62907)
Rebuild and redeploy any custom kernels shipped on Cortina Gemini hardware after cherry-picking the fix
Audit vendor firmware and OpenWrt or Yocto images that target Gemini SoCs for the presence of the patch

Patch Information

The fix converts the shared static SKB to a per-port field carried in the driver's port structure between gmac_rx() invocations. The pointer is cleared after napi_gro_frags(), on error paths following napi_free_frags(), and when a port is stopped. Kernel maintainers backported the change across multiple stable branches; consult the eight stable commits referenced in NVD for the branch matching your deployed kernel.

Workarounds

Disable one of the two Gemini ethernet ports using ip link set <iface> down so that only a single port drives gmac_rx()
Bind workloads to a single interface where possible until the patched kernel is deployed
Restrict the affected device to management networks to reduce exposure to attacker-controlled dual-port traffic patterns

bash

# Verify the running kernel and disable the second Gemini port as a temporary workaround
uname -r
ethtool -i eth0 | grep driver
ethtool -i eth1 | grep driver
ip link set eth1 down