CVE-2026-64110: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64110 Overview

CVE-2026-64110 is a memory leak vulnerability in the Linux kernel's igc network driver, which supports Intel I225/I226 2.5 Gigabit Ethernet controllers. The flaw resides in the igc_fpe_xmit_smd_frame() function used for Frame Preemption (FPE) support. When igc_fpe_init_tx_descriptor() fails inside this function, the allocated socket buffer (skb) is not released, resulting in a kernel memory leak on every failed transmission attempt. The issue was identified through kmemleak reporting during fault injection testing on an I226 adapter with ethtool --set-mm verify/tx/pmac options enabled. The fix calls dev_kfree_skb_any() on the failure path to properly release the buffer.

Critical Impact
Repeated failures in the transmit descriptor initialization path can exhaust kernel memory over time, degrading system stability on hosts using the igc driver with Frame Preemption enabled.

Affected Products

Linux kernel versions containing the igc Frame Preemption support with the vulnerable igc_fpe_xmit_smd_frame() implementation
Systems using Intel I225/I226 2.5GbE controllers with FPE enabled via ethtool --set-mm
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64110 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64110

Vulnerability Analysis

The vulnerability is a kernel-space memory leak [CWE-401] in the Intel igc Ethernet driver. The function igc_fpe_xmit_smd_frame() is invoked as part of the IEEE 802.3br Frame Preemption verification handshake, which sends Signaling and Merge Data (SMD) frames to the link partner. Inside this function, the driver allocates a new skb via __alloc_skb() before calling igc_fpe_init_tx_descriptor() to build the transmit descriptor.

When igc_fpe_init_tx_descriptor() returns an error, the original code path returns without freeing the previously allocated skb. The allocation therefore becomes unreferenced kernel memory. The kmemleak subsystem captured the leak with a backtrace showing kmem_cache_alloc_node_noprof → __alloc_skb → igc_fpe_xmit_smd_frame → igc_fpe_send_mpacket → ethtool_mmsv_verify_timer.

Root Cause

The root cause is missing cleanup on an error branch. The driver allocates a resource, then fails to release it when a subsequent initialization step fails. This is a classic error-handling omission pattern in kernel drivers where the success path releases the skb through the normal transmit completion, but the failure path lacked an explicit dev_kfree_skb_any() call.

Attack Vector

Exploitation requires the igc driver to be active with Frame Preemption enabled and a condition that repeatedly triggers igc_fpe_init_tx_descriptor() failure. The verify timer fires periodically during MAC Merge verification, so persistent failure conditions cause continuous leaks. There is no evidence of remote or unprivileged triggering. The impact is limited to resource exhaustion on the affected host.

The vulnerability mechanism is described in the upstream commit messages. See the kernel commit fixing the leak for the exact code change.

Detection Methods for CVE-2026-64110

Indicators of Compromise

Kernel kmemleak reports referencing igc_fpe_xmit_smd_frame in the allocation backtrace
Steady growth in SUnreclaim and slab usage on hosts running the igc driver with pmac-enabled on
Repeated ethtool_mmsv_verify_timer invocations paired with transmit descriptor errors in dmesg

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test systems and scan /sys/kernel/debug/kmemleak for unreferenced objects matching the igc allocation path
Monitor kernel logs for descriptor initialization failures emitted by the igc driver when Frame Preemption is active
Track long-term slab growth on hosts using I225/I226 NICs with ethtool --show-mm reporting FPE enabled

Monitoring Recommendations

Baseline kernel slab consumption on hosts with the igc driver loaded and alert on sustained upward drift
Correlate FPE verification state transitions with skbuff_head_cache allocation counts from /proc/slabinfo
Include kernel version and igc driver version in asset inventories to identify unpatched hosts

How to Mitigate CVE-2026-64110

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits 3ebf056, e935c37, or f1bafd3 for the igc driver
Identify hosts using Intel I225/I226 NICs with Frame Preemption enabled and prioritize them for patching
If patching is delayed, disable MAC Merge/Frame Preemption on affected interfaces to avoid triggering the leaking code path

Patch Information

The fix adds a dev_kfree_skb_any() call on the failure branch of igc_fpe_xmit_smd_frame() so the allocated skb is released when igc_fpe_init_tx_descriptor() returns an error. Patched commits are available at git.kernel.org commit 3ebf056, git.kernel.org commit e935c37, and git.kernel.org commit f1bafd3. Apply the fix through your distribution's stable kernel update channel.

Workarounds

Disable Frame Preemption on affected interfaces using ethtool --set-mm $DEV verify-enabled off tx-enabled off pmac-enabled off
Avoid using MAC Merge features on I225/I226 adapters until the patched kernel is deployed
Schedule periodic reboots on long-running hosts where the driver cannot be updated immediately to reclaim leaked memory

bash

# Disable MAC Merge / Frame Preemption on the affected interface
ethtool --set-mm eth0 verify-enabled off tx-enabled off pmac-enabled off

# Verify the current Merge mode status
ethtool --show-mm eth0

# Check for kmemleak reports referencing the igc driver
cat /sys/kernel/debug/kmemleak | grep -A 20 igc_fpe_xmit_smd_frame