{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-64121",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-64121",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-07-19T15:40:19.745Z",
    "updatedAt": "2026-07-19T15:40:19.745Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "net: ifb: report ethtool stats over num_tx_queues",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ifb: report ethtool stats over num_tx_queues\n\nifb_dev_init() allocates dp->tx_private to dev->num_tx_queues\nentries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB\nper-queue RX and TX stats live in those entries: ifb_xmit() updates\ntxp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates\ntxp->tx_stats, and ifb_stats64() aggregates both over\ndev->num_tx_queues.\n\nThe ethtool stats callbacks instead size and walk the per-queue\nstats with dev->real_num_rx_queues and dev->real_num_tx_queues. With\nan asymmetric device where the RX queue count exceeds the TX queue\ncount, for example:\n\n    ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb\n    ethtool -S ifb10\n\nifb_get_ethtool_stats() indexes past the tx_private allocation and\ncopies adjacent slab data through ETHTOOL_GSTATS.\n\nUse dev->num_tx_queues consistently for the stats strings, the\nstats count, and the stats data walks. This reports one RX stats\ngroup and one TX stats group for each backing ifb_q_private entry,\nwhich is the queue set IFB can actually populate.\n\nReproduced under UML+KASAN at v7.1-rc2:\n\n  BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae\n  Read of size 8 at addr 0000000062dbd228 by task ethtool/36\n  ifb_fill_stats_data+0x3c/0xae\n  ifb_get_ethtool_stats+0xc0/0x129\n  __dev_ethtool+0x1ca5/0x363c\n  dev_ethtool+0x123/0x1b3\n  dev_ioctl+0x56c/0x744\n  sock_do_ioctl+0x15f/0x1b2\n  sock_ioctl+0x4d5/0x50a\n  sys_ioctl+0xd8b/0xde9\n\nWith the patch applied, the same UML+KASAN repro is silent and\nethtool -S ifb10 reports only the stats backed by the single\nallocated tx_private entry.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6afdb8113cb007f9332f59a9b7fd45731b8a9de5"
            },
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "16bd798cb6d8337d7c3eea1adc412f31b5181d5b"
            },
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "301a554e458e2f5ec47f2c336a7cb03b877f9fd6"
            },
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f8a5a76b4a683043c6eff2a060bcaa17f9316ad5"
            },
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4"
            },
            {
              "version": "a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "5db89c99566fc4728cc92e941d8e1975711e24b5"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.17",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.17"
            },
            {
              "version": "6.1.175",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.142",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.92",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.34",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.0.11",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "version": "7.1",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}