CVE-2026-64113 Overview
CVE-2026-64113 is a use-after-free vulnerability in the Linux kernel's ixgbevf driver, which supports Intel 82599 Virtual Function (VF) network devices. The flaw resides in ixgbevf_clean_rx_irq(), where the Virtual Ethernet Port Aggregator (VEPA) multicast source-pruning path frees an skb (socket buffer) but fails to null the pointer before continuing the receive loop. The next iteration dereferences the freed buffer through skb_shinfo(skb)->nr_frags, corrupting memory in NAPI softirq context. The bug was confirmed under Kernel Address Sanitizer (KASAN) using a reproducer module.
Critical Impact
A remote attacker on the same network segment can trigger memory corruption in kernel softirq context by sending crafted multicast frames to a VF interface, enabling denial of service or potential kernel code execution.
Affected Products
- Linux kernel ixgbevf driver (Intel 82599 Virtual Function)
- Linux kernel versions containing the VEPA multicast pruning code path prior to the fix commits
- Virtualized environments using Intel 82599 SR-IOV VFs with VEPA mode enabled
Discovery Timeline
- 2026-07-19 - CVE-2026-64113 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64113
Vulnerability Analysis
The vulnerability is a classic use-after-free (UAF) in the receive interrupt handler of the ixgbevf driver. The function ixgbevf_clean_rx_irq() processes incoming Rx descriptors in a while loop and, as a VEPA workaround, drops frames whose source MAC matches the VF's own address. The drop path calls dev_kfree_skb_irq(skb) and executes continue, skipping the skb = NULL assignment at the bottom of the loop body.
Because the skb pointer is declared outside the loop, it retains its stale value pointing to freed memory. The next iteration evaluates the else if (skb) branch as true and calls ixgbevf_add_rx_frag() on the freed buffer, reading skb_shinfo(skb)->nr_frags. This produces the KASAN report slab-use-after-free in ixgbevf_uaf_test_init against a freed 208-byte region.
Root Cause
The root cause is a missing pointer nullification after dev_kfree_skb_irq() in the pruning path. The sibling iavf driver handles the identical pattern correctly by setting the pointer to NULL before continue. The ixgbevf implementation omitted this reset, allowing loop-carried state to reference deallocated memory across descriptor iterations.
Attack Vector
An attacker on the same broadcast domain can transmit multicast frames whose source MAC address matches the target VF's MAC. Each such frame drives ixgbevf_clean_rx_irq() down the pruning path and primes the stale pointer. A subsequent legitimate or attacker-supplied frame then triggers the UAF read inside ixgbevf_add_rx_frag(). Because the corruption occurs in NAPI softirq context, exploitation can affect the kernel slab allocator and potentially be shaped into arbitrary read or write primitives depending on adjacent slab objects.
No public proof-of-concept exploit weaponizes this beyond the KASAN reproducer described in the advisory. Refer to the Linux Kernel Commit 3d931ac62411 for the authoritative fix.
Detection Methods for CVE-2026-64113
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in ixgbevf_clean_rx_irq or ixgbevf_add_rx_frag within kernel logs
- Unexpected kernel oops, general protection faults, or slab corruption warnings originating from softirq context on hosts running the ixgbevf driver
- Sudden loss of VF network connectivity accompanied by NAPI-related stack traces in dmesg
Detection Strategies
- Enable KASAN on test kernels to surface the exact UAF signature described in the advisory
- Audit /proc/kallsyms and modinfo ixgbevf output to enumerate hosts running the vulnerable driver version
- Correlate kernel crash telemetry with SR-IOV VF assignments to identify affected virtualized workloads
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized log platform and alert on KASAN, Oops, or BUG: strings referencing ixgbevf
- Monitor multicast traffic patterns on VF-attached interfaces for anomalous frames carrying the VF's own source MAC
- Track kernel package versions across the fleet to confirm patched builds are deployed on all SR-IOV hosts
How to Mitigate CVE-2026-64113
Immediate Actions Required
- Apply the upstream Linux kernel fix that nulls the skb pointer after dev_kfree_skb_irq() in ixgbevf_clean_rx_irq()
- Update to distribution kernel builds that incorporate the referenced stable commits
- Reboot affected hosts after patching to ensure the corrected ixgbevf module is loaded
Patch Information
The fix is distributed across multiple stable branches. Reference commits include Linux Kernel Commit 3d931ac62411, Linux Kernel Commit 55b3e91d62b2, Linux Kernel Commit 5d49b568c188, Linux Kernel Commit 6ef30384a50a, Linux Kernel Commit a244395d8c56, Linux Kernel Commit add70e2682c0, Linux Kernel Commit dfef79e09ed2, and Linux Kernel Commit e8768bcbe5cd. Apply the patch series matching your kernel branch.
Workarounds
- Disable VEPA mode on affected VF interfaces where the multicast pruning path is unnecessary
- Unload the ixgbevf module and migrate workloads to hosts using patched kernels until updates are staged
- Restrict layer 2 access to VF interfaces so untrusted endpoints cannot inject multicast frames matching the VF MAC
# Verify the running ixgbevf driver version and confirm patch state
modinfo ixgbevf | grep -E 'version|filename'
dmesg | grep -i ixgbevf
# Reload the module after applying a patched kernel package
sudo modprobe -r ixgbevf && sudo modprobe ixgbevf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
