Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64121— net: ifb: report ethtool stats over num_tx_queues

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.17版本存在越界读漏洞，该漏洞源于ifb设备中ethtool统计信息回调函数使用real_num_rx_queues和real_num_tx_queues索引超出分配的tx_private缓冲区，在RX队列数超过TX队列数时导致越界读取，可能泄露相邻slab数据。以下版本受到影响：5.17版本。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< 6afdb8113cb007f9332f59a9b7fd45731b8a9de5 affected
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< 16bd798cb6d8337d7c3eea1adc412f31b5181d5b affected
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< 301a554e458e2f5ec47f2c336a7cb03b877f9fd6 affected
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< f8a5a76b4a683043c6eff2a060bcaa17f9316ad5 affected
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< 2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4 affected
a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1< 5db89c99566fc4728cc92e941d8e1975711e24b5 affected
5.17 affected
< 5.17 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: ifb: report ethtool stats over num_tx_queues
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num_tx_queues ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB per-queue RX and TX stats live in those entries: ifb_xmit() updates txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both over dev->num_tx_queues. The ethtool stats callbacks instead size and walk the per-queue stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example: ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10 ifb_get_ethtool_stats() indexes past the tx_private allocation and copies adjacent slab data through ETHTOOL_GSTATS. Use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifb_q_private entry, which is the queue set IFB can actually populate. Reproduced under UML+KASAN at v7.1-rc2: BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifb_fill_stats_data+0x3c/0xae ifb_get_ethtool_stats+0xc0/0x129 __dev_ethtool+0x1ca5/0x363c dev_ethtool+0x123/0x1b3 dev_ioctl+0x56c/0x744 sock_do_ioctl+0x15f/0x1b2 sock_ioctl+0x4d5/0x50a sys_ioctl+0xd8b/0xde9 With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.17版本存在越界读漏洞，该漏洞源于ifb设备中ethtool统计信息回调函数使用real_num_rx_queues和real_num_tx_queues索引超出分配的tx_private缓冲区，在RX队列数超过TX队列数时导致越界读取，可能泄露相邻slab数据。以下版本受到影响：5.17版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 ~ 6afdb8113cb007f9332f59a9b7fd45731b8a9de5 -
Linux Linux 5.17 -

II. Public POCs for CVE-2026-64121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64121

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64121 (6)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-63994 9.8 CRITICAL tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-63993 9.8 CRITICAL vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63825 9.8 CRITICAL gcov: use atomic counter updates to fix concurrent access crashes
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-63886 9.8 CRITICAL scsi: target: iscsi: Validate CHAP_R length before base64 decode
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64132 9.8 CRITICAL ipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-64136 9.8 CRITICAL smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64121

No comments yet

Leave a comment