CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues
In the Linux kernel, the following vulnerability has been resolved:
net: ifb: report ethtool stats over numtxqueues
ifbdevinit() allocates dp->txprivate to dev->numtxqueues entries via kzallocobjs(txp, dev->numtxqueues). Both IFB per-queue RX and TX stats live in those entries: ifbxmit() updates txp->rxstats using the skb queue mapping, ifbritasklet() updates txp->txstats, and ifbstats64() aggregates both over dev->numtxqueues.
The ethtool stats callbacks instead size and walk the per-queue stats with dev->realnumrxqueues and dev->realnumtxqueues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example:
ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10
ifbgetethtoolstats() indexes past the txprivate allocation and copies adjacent slab data through ETHTOOLGSTATS.
Use dev->numtxqueues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifbqprivate entry, which is the queue set IFB can actually populate.
Reproduced under UML+KASAN at v7.1-rc2:
BUG: KASAN: slab-out-of-bounds in ifbfillstatsdata+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifbfillstatsdata+0x3c/0xae ifbgetethtoolstats+0xc0/0x129 devethtool+0x1ca5/0x363c devethtool+0x123/0x1b3 devioctl+0x56c/0x744 sockdoioctl+0x15f/0x1b2 sockioctl+0x4d5/0x50a sysioctl+0xd8b/0xde9
With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated txprivate entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Patch the ifb ethtool stats implementation so that when formatting/iterating ETHTOOL_GSTATS per-queue data, the code uses dev->num_tx_queues consistently for the stats strings and walks the per-queue TX stats structures based on dev->num_tx_queues to avoid indexing past the allocated tx_private entries.
Linux kernel ifb (Intermediate Functional Block) ethtool stats Use dev->num_tx_queues consistently for ETHTOOL_GSTATS stats strings and indexing = Apply the code change so ethtool stats callbacks size and walk the per-queue structures using dev->num_tx_queues (instead of dev->real_num_tx_queues / mismatched queue counts)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64121?
CVE-2026-64121 has a risk score of 18, indicating a high severity vulnerability.
How do I fix CVE-2026-64121?
To fix CVE-2026-64121, it is recommended to update your Linux kernel to the latest version where the vulnerability has been patched.
Which software is affected by CVE-2026-64121?
CVE-2026-64121 affects the Linux kernel, particularly related to the net: ifb module.
What components are impacted by CVE-2026-64121?
CVE-2026-64121 impacts the IFB per-queue RX and TX statistics within the Linux kernel networking stack.
When was CVE-2026-64121 published?
CVE-2026-64121 was published on July 19, 2026.