CVE-2026-68321: Linux Kernel FDIR Filter Leak Vulnerability

CVE-2026-68321 Overview

CVE-2026-68321 is a memory leak vulnerability in the Linux kernel txgbe network driver. The flaw affects the Flow Director (FDIR) filter cleanup path when the driver is removed while the interface is down. Perfect FDIR filters can be added while the interface is down and are retained on a software list for later restore. Because unregister_netdev() only calls ndo_stop when the device is up, the txgbe_fdir_filter_exit() call inside txgbe_close() is skipped, and the filter list is leaked on driver remove. The upstream fix frees the filter list from txgbe_remove() as well.

Critical Impact
Kernel memory leak in the txgbe driver that persists filter entries when the driver is unloaded with the interface down, gradually consuming kernel memory over repeated load/unload cycles.

Affected Products

Linux kernel builds shipping the txgbe driver (Wangxun 10GbE Ethernet)
Distributions consuming affected upstream kernel versions prior to the fix commits
Systems using perfect FDIR filters on Wangxun 10GbE interfaces

Discovery Timeline

2026-08-10 - CVE-2026-68321 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68321

Vulnerability Analysis

The vulnerability resides in the txgbe driver's resource cleanup flow. Perfect FDIR filters are user-configurable rules that steer matching flows to specific receive queues. The driver allows administrators to add these filters even when the interface is administratively down, storing them on an in-memory software list so they can be re-programmed into hardware once the interface comes up.

During driver removal, the kernel invokes unregister_netdev(). This function only calls the driver's ndo_stop handler if the interface is currently up. When the interface is down at remove time, txgbe_close() never runs, and the filter cleanup routine txgbe_fdir_filter_exit() invoked from it is skipped. The allocated filter entries remain orphaned in kernel memory after the module is unloaded.

Root Cause

The root cause is an incomplete cleanup path in the driver lifecycle. The cleanup logic that frees FDIR filter entries lives only in the close path, but filter allocations can occur outside of the up/down lifecycle. The remove path lacked an equivalent call to release those allocations, resulting in a Memory Leak [CWE-401] whenever the driver is unloaded with the interface down.

Attack Vector

This is a local, privilege-bounded issue. Adding FDIR filters and loading or unloading kernel modules typically requires CAP_NET_ADMIN and CAP_SYS_MODULE respectively. Exploitation is limited to gradual kernel memory exhaustion on hosts where an administrator or automation repeatedly configures filters and unloads the driver while the interface is down. There is no remote attack surface and no code execution path reported.

The upstream commits 2d34421, 4946dea, 5c2f042, and ecaa378 add the filter list free call to txgbe_remove() so the software filter list is released regardless of interface state at removal.

Detection Methods for CVE-2026-68321

Indicators of Compromise

Steadily increasing Slab or kmalloc accounting in /proc/meminfo and /proc/slabinfo on hosts running the txgbe driver
Kernel memory growth correlated with repeated modprobe -r txgbe and modprobe txgbe cycles while the interface remains down
FDIR filter configuration operations via ethtool -N on Wangxun 10GbE interfaces prior to driver unload

Detection Strategies

Track kernel version and txgbe module version across the fleet and flag hosts running kernels prior to the fix commits
Monitor kernel memory growth trends on systems that host Wangxun 10GbE NICs, especially long-running hypervisors or appliances
Audit ethtool command history and configuration-management runs for FDIR filter changes followed by driver reload sequences

Monitoring Recommendations

Alert on unexpected Slab growth exceeding baseline on affected hosts
Log all module load and unload events for txgbe via auditd rules on init_module and delete_module syscalls
Include Wangxun NIC firmware and driver telemetry in host inventory collection

How to Mitigate CVE-2026-68321

Immediate Actions Required

Identify all hosts using the txgbe driver and confirm current kernel version against distribution advisories
Apply the stable kernel update containing commits 2d34421, 4946dea, 5c2f042, or ecaa378 once available in your distribution
Avoid unloading the txgbe module while FDIR filters are configured on a down interface until the patched kernel is deployed

Patch Information

The fix is available in the upstream stable trees. See the Kernel Git Commit 2d34421, Kernel Git Commit 4946dea, Kernel Git Commit 5c2f042, and Kernel Git Commit ecaa378. Rebuild or update the kernel from a distribution package that includes these commits and reboot the affected system.

Workarounds

Bring the interface up before unloading the txgbe module so ndo_stop runs and the existing cleanup path frees the filter list
Clear all FDIR filters with ethtool -N <iface> delete <loc> for each configured rule prior to unloading the driver
Restrict CAP_NET_ADMIN and module unload privileges to trusted operators to limit repeated leak-inducing sequences

bash

# Clear FDIR filters and bring interface up before unloading txgbe
for loc in $(ethtool -n eth0 | awk '/Filter:/ {print $2}'); do
    ethtool -N eth0 delete "$loc"
done
ip link set eth0 up
rmmod txgbe