In the Linux kernel, the following vulnerability has been resolved:

net: ifb: report ethtool stats over num_tx_queues

ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues
entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB
per-queue RX and TX stats live in those entries: ifb_xmit() updates
txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates
txp->tx_stats, and ifb_stats64() aggregates both over
dev->num_tx_queues.

The ethtool stats callbacks instead size and walk the per-queue
stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With
an asymmetric device where the RX queue count exceeds the TX queue
count, for example:

ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb
ethtool -S ifb10

ifb_get_ethtool_stats() indexes past the tx_private allocation and
copies adjacent slab data through ETHTOOL_GSTATS.

Use dev->num_tx_queues consistently for the stats strings, the
stats count, and the stats data walks. This reports one RX stats
group and one TX stats group for each backing ifb_q_private entry,
which is the queue set IFB can actually populate.

Reproduced under UML+KASAN at v7.1-rc2:

BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae
Read of size 8 at addr 0000000062dbd228 by task ethtool/36
ifb_fill_stats_data+0x3c/0xae
ifb_get_ethtool_stats+0xc0/0x129
__dev_ethtool+0x1ca5/0x363c
dev_ethtool+0x123/0x1b3
dev_ioctl+0x56c/0x744
sock_do_ioctl+0x15f/0x1b2
sock_ioctl+0x4d5/0x50a
sys_ioctl+0xd8b/0xde9

With the patch applied, the same UML+KASAN repro is silent and
ethtool -S ifb10 reports only the stats backed by the single
allocated tx_private entry.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < 6afdb8113cb007f9332f59a9b7fd45731b8a9de5
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < 16bd798cb6d8337d7c3eea1adc412f31b5181d5b
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < 301a554e458e2f5ec47f2c336a7cb03b877f9fd6
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < f8a5a76b4a683043c6eff2a060bcaa17f9316ad5
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < 2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 affected < 5db89c99566fc4728cc92e941d8e1975711e24b5
Linux Linux affected
Version Status Constraints
5.17 affected —
0 unaffected < 5.17
6.1.175 unaffected ≤ 6.1.*
6.6.142 unaffected ≤ 6.6.*
6.12.92 unaffected ≤ 6.12.*
6.18.34 unaffected ≤ 6.18.*
7.0.11 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b cve-icon
https://git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4 cve-icon
https://git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6 cve-icon
https://git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5 cve-icon
https://git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5 cve-icon
https://git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5 cve-icon
https://lore.kernel.org/linux-cve-announce/2026071924-CVE-2026-64121-7da8@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64121 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64121 cve-icon
History

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num_tx_queues ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB per-queue RX and TX stats live in those entries: ifb_xmit() updates txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both over dev->num_tx_queues. The ethtool stats callbacks instead size and walk the per-queue stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example: ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10 ifb_get_ethtool_stats() indexes past the tx_private allocation and copies adjacent slab data through ETHTOOL_GSTATS. Use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifb_q_private entry, which is the queue set IFB can actually populate. Reproduced under UML+KASAN at v7.1-rc2: BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifb_fill_stats_data+0x3c/0xae ifb_get_ethtool_stats+0xc0/0x129 __dev_ethtool+0x1ca5/0x363c dev_ethtool+0x123/0x1b3 dev_ioctl+0x56c/0x744 sock_do_ioctl+0x15f/0x1b2 sock_ioctl+0x4d5/0x50a sys_ioctl+0xd8b/0xde9 With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry.
Title net: ifb: report ethtool stats over num_tx_queues
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T15:40:19.745Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64121

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64121 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses