Linux: Out-of-bounds Read
CVE-2026-64121 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 6afdb8113cb007f9332f59a9b7fd45731b8a9de5, 16bd798cb6d8337d7c3eea1adc412f31b5181d5b, 301a554e458e2f5ec47f2c336a7cb03b877f9fd6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 6afdb8113cb007f9332f59a9b7fd45731b8a9de5 or 16bd798cb6d8337d7c3eea1adc412f31b5181d5b or 301a554e458e2f5ec47f2c336a7cb03b877f9fd6 or f8a5a76b4a683043c6eff2a060bcaa17f9316ad5, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.175 or 6.6.142 or 6.12.92 or 6.18.34, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, 6afdb8113cb007f9332f59a9b7fd45731b8a9de5; a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, 16bd798cb6d8337d7c3eea1adc412f31b5181d5b; a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, 301a554e458e2f5ec47f2c336a7cb03b877f9fd6; a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, f8a5a76b4a683043c6eff2a060bcaa17f9316ad5; a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, 2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4; a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 up to, but not including, 5db89c99566fc4728cc92e941d8e1975711e24b5; 5.17 | 6afdb8113cb007f9332f59a9b7fd45731b8a9de5, 16bd798cb6d8337d7c3eea1adc412f31b5181d5b, 301a554e458e2f5ec47f2c336a7cb03b877f9fd6, f8a5a76b4a683043c6eff2a060bcaa17f9316ad5, 2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4, 5db89c99566fc4728cc92e941d8e1975711e24b5 |
| Linux | Linux Kernel | 5.17 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.1 | 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num_tx_queues ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB per-queue RX and TX stats live in those entries: ifb_xmit() updates txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates txp->tx_stats, and ifb_stats64() aggregates both over dev->num_tx_queues. The ethtool stats callbacks instead size and walk the per-queue stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example: ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb ethtool -S ifb10 ifb_get_ethtool_stats() indexes past the tx_private allocation and copies adjacent slab data through ETHTOOL_GSTATS. Use dev->num_tx_queues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifb_q_private entry, which is the queue set IFB can actually populate. Reproduced under UML+KASAN at v7.1-rc2: BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifb_fill_stats_data+0x3c/0xae ifb_get_ethtool_stats+0xc0/0x129 __dev_ethtool+0x1ca5/0x363c dev_ethtool+0x123/0x1b3 dev_ioctl+0x56c/0x744 sock_do_ioctl+0x15f/0x1b2 sock_ioctl+0x4d5/0x50a sys_ioctl+0xd8b/0xde9 With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b
- git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4
- git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6
- git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5
- git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5
- git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5
Recent Out-of-bounds Read vulnerabilities
- 7.1 High severity
- 7.8 High severity
- 7.3 High severity
- 7.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
Spotted an error? Tell us.