CVE-2026-64113ixgbevf: fix use-after-free in VEPA multicast source pruning
- 9.8CriticalCVSS base score
- 0.53%Exploitation in 30 daysEPSS · top 55% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
Timeline
ID reserved
By Linux
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < 3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < 6ef30384a50a50e4a484cddf341bc27de31aa3de
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < 55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < add70e2682c0ad3be2a5810bcf1bc13963ba4df9
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < a244395d8c563ed1bb26c3ef708db6aeeaa08084
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < dfef79e09ed2f5df975c98547f97f5d7f8982a24
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < e8768bcbe5cd30c4ea36a22022c9ffaa66903693
- affected bad17234ba702a50aeec50ab04724ee58af89607 – < 5d49b568c188dc77199d8d2b959c91da8cc27cf1
- affected 3.19
- unaffected < 3.19
- unaffected 5.10.258 – ≤ 5.10.*
- unaffected 5.15.209 – ≤ 5.15.*
- unaffected 6.1.175 – ≤ 6.1.*
- unaffected 6.6.142 – ≤ 6.6.*
- unaffected 6.12.92 – ≤ 6.12.*
- unaffected 6.18.34 – ≤ 6.18.*
- unaffected 7.0.11 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References8
- https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb (opens in a new tab)
- https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de (opens in a new tab)
- https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1 (opens in a new tab)
- https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9 (opens in a new tab)
- https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084 (opens in a new tab)
- https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24 (opens in a new tab)
- https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693 (opens in a new tab)
- https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-45798 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64113)Record last updated .