CVE-2026-64035: igc: set tx buffer type for SMD frames
In the Linux kernel, the following vulnerability has been resolved:
igc: set tx buffer type for SMD frames
Sashiko pointed out that igcfpeinitsmdframe() initializes igctxbuffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp
Since igctxbuffer entries are reused, a stale XDP or XSK type can remain and make TX completion use the wrong cleanup path.
Set the buffer type to IGCTXBUFFERTYPESKB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch igc: set tx buffer type for SMD frames
Event History
Frequently Asked Questions
What conditions are needed for the incorrect cleanup path to occur?
An SMD skb must be initialized through igc_fpe_init_smd_frame() using a reused igc_tx_buffer entry whose stale type is XDP or XSK. Because the SMD initialization did not set its own type, TX completion can follow the cleanup path associated with that stale type.
Which component should be investigated during triage?
Investigate Linux kernel systems using the igc driver, specifically the handling of SMD frames and transmit-buffer reuse. The issue is in the SMD-frame initialization path rather than a general TX-buffer issue described for all drivers.
How can I determine whether the fix is present?
Check whether igc_fpe_init_smd_frame() explicitly sets the transmit buffer type to IGC_TX_BUFFER_TYPE_SKB. The provided stable-kernel references identify commits containing the resolution, but no affected or fixed kernel version numbers are supplied.