CVE-2026-64121: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64121 Overview

CVE-2026-64121 is an out-of-bounds read vulnerability in the Linux kernel's Intermediate Functional Block (IFB) network driver. The flaw resides in ifb_get_ethtool_stats() and ifb_fill_stats_data(), where the ethtool statistics path walks per-queue stats using dev->real_num_rx_queues and dev->real_num_tx_queues. The underlying tx_private array, however, is allocated based on dev->num_tx_queues. On asymmetric IFB devices where RX queue count exceeds TX queue count, ethtool reads past the allocation and copies adjacent slab data to userspace through ETHTOOL_GSTATS.

Critical Impact
Local users can trigger a slab out-of-bounds read in the IFB driver via ethtool, leaking adjacent kernel slab contents to userspace.

Affected Products

Linux kernel IFB (Intermediate Functional Block) driver
Kernel builds prior to the fix commits referenced in the stable tree
Reproduced on Linux kernel v7.1-rc2 under UML with KASAN

Discovery Timeline

2026-07-19 - CVE-2026-64121 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64121

Vulnerability Analysis

The IFB driver uses per-queue private structures to track RX and TX statistics. In ifb_dev_init(), the driver calls kzalloc_objs(*txp, dev->num_tx_queues) to allocate one ifb_q_private entry per TX queue. Both RX and TX per-queue counters live inside these entries. ifb_xmit() updates txp->rx_stats indexed by the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both counters across dev->num_tx_queues.

The ethtool statistics callbacks were inconsistent with this allocation model. They sized and walked per-queue stats using dev->real_num_rx_queues and dev->real_num_tx_queues. When an operator created an asymmetric IFB device with more RX queues than TX queues, the ethtool code indexed past the actual tx_private allocation.

Root Cause

The root cause is a mismatch between the allocation dimension (num_tx_queues) and the iteration dimension (real_num_rx_queues/real_num_tx_queues) used by the ethtool stats path. This is a classic out-of-bounds read caused by using the wrong bound when walking a heap-allocated array.

Attack Vector

A local user with permission to invoke ETHTOOL_GSTATS on an IFB device can trigger the read. Creating an asymmetric IFB device with ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb and then running ethtool -S ifb10 reproduces the condition. The KASAN report on v7.1-rc2 shows the invalid read originating in ifb_fill_stats_data+0x3c/0xae reached through sock_ioctl and __dev_ethtool. The copied bytes flow back to userspace inside the ethtool stats buffer, exposing adjacent slab memory contents.

The kernel patch corrects the callbacks to use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. After the fix, ethtool reports one RX and one TX stats group per backing ifb_q_private entry.

Detection Methods for CVE-2026-64121

Indicators of Compromise

KASAN slab-out-of-bounds reports naming ifb_fill_stats_data or ifb_get_ethtool_stats in kernel logs.
Unexpected ETHTOOL_GSTATS ioctl activity against IFB interfaces from non-administrative processes.
Creation of IFB devices with mismatched numrxqueues and numtxqueues values on production hosts.

Detection Strategies

Enable KASAN on test kernels and exercise ethtool -S against IFB devices to surface the bounds violation.
Audit installed kernel versions against the fix commits 16bd798, 2638e177, 301a554e, 5db89c99, 6afdb811, and f8a5a76b in the stable tree.
Monitor syslog and dmesg for any slab-out-of-bounds warnings referencing the IFB driver.

Monitoring Recommendations

Track ip link add ... type ifb operations and correlate with subsequent ethtool ioctls on the same interface.
Alert on kernel taint changes and KASAN-style diagnostic output on hosts running networking workloads that use IFB.
Baseline which service accounts legitimately invoke ethtool against traffic-shaping interfaces.

How to Mitigate CVE-2026-64121

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits and rebuild affected kernels.
Restrict CAP_NET_ADMIN and the ability to create IFB devices to trusted administrators only.
Where the IFB driver is not required, unload the module and blacklist it to remove the attack surface.

Patch Information

The fix updates the ethtool callbacks in the IFB driver to use dev->num_tx_queues consistently for stats string generation, stats count reporting, and stats data traversal. Reference commits in the stable tree: Kernel Git Commit 16bd798, Kernel Git Commit 2638e17, Kernel Git Commit 301a554, Kernel Git Commit 5db89c9, Kernel Git Commit 6afdb81, and Kernel Git Commit f8a5a76.

Workarounds

Avoid creating asymmetric IFB devices where numrxqueues exceeds numtxqueues until patched kernels are deployed.
Blacklist the ifb kernel module on systems that do not need intermediate functional block traffic redirection.
Limit invocation of ethtool -S on IFB interfaces to trusted administrators through sudo policies or MAC controls.

bash

# Prevent the ifb module from loading on hosts that do not require it
echo "install ifb /bin/true" | sudo tee /etc/modprobe.d/disable-ifb.conf
sudo rmmod ifb 2>/dev/null || true