by Kastro
Paper/Archive/CVE-2026-64035

CVE-2026-64035

Linux Linux — igc: set tx buffer type for SMD frames

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 38.4.384 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp Since igc_tx_buffer entries are reused, a stale XDP or XSK type can remain and make TX completion use the wrong cleanup path. Set the buffer type to IGC_TX_BUFFER_TYPE_SKB.

Affected

ProductAffectedFixed inSource
Linux5422570c0010bb968738f9256eb2bf83e79b4d63 – < 1f83545f432d106d5fc71d3997b2d382104ebcc41f83545f432d106d5fc71d3997b2d382104ebcc4CNA
Linux5422570c0010bb968738f9256eb2bf83e79b4d63 – < 1c8587bd025244aa52061f5ceecbf5e68a1063d91c8587bd025244aa52061f5ceecbf5e68a1063d9CNA
Linux5422570c0010bb968738f9256eb2bf83e79b4d63 – < 5acc641e590e008caaed480ed9ffae47cf7ecbdf5acc641e590e008caaed480ed9ffae47cf7ecbdfCNA
Linux6.166.18.34CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/1f83545f432d106d5fc71d3997b2d382104ebcc4refgit.kernel.org/stable/c/1c8587bd025244aa52061f5ceecbf5e68a1063d9refgit.kernel.org/stable/c/5acc641e590e008caaed480ed9ffae47cf7ecbdf