---
id: CVE-2026-64110
title: 'igc: fix potential skb leak in igc_fpe_xmit_smd_frame()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  igc: fix potential skb leak in igc_fpe_xmit_smd_frame()

  When igc_fpe_init_tx_descriptor() fails, no one takes care of an
  allocated skb, leaking it. [1]
  Use dev_kfree_s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 <
    f1bafd35f11b3aca1c7bb38da173b8787364a04c
  - >-
    Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 <
    3ebf056556138e74c640e6dc2b3848abd398b460
  - >-
    Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 <
    e935c37b8a94bb256fada6395a5d05e1c0c6bdaf
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:30:07.742531Z'
published: '2026-07-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:26.176Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64110'
references:
  - url: 'https://git.kernel.org/stable/c/f1bafd35f11b3aca1c7bb38da173b8787364a04c'
  - url: 'https://git.kernel.org/stable/c/3ebf056556138e74c640e6dc2b3848abd398b460'
  - url: 'https://git.kernel.org/stable/c/e935c37b8a94bb256fada6395a5d05e1c0c6bdaf'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05209
ingestedAt: '2026-11-06T16:57:43.236Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

igc: fix potential skb leak in igc_fpe_xmit_smd_frame()

When igc_fpe_init_tx_descriptor() fails, no one takes care of an
allocated skb, leaking it. [1]
Use dev_kfree_skb_any() on failure.

Tested on an I226 adapter with the following command, while injecting
faults in igc_fpe_init_tx_descriptor() to trigger the error path.
 # ethtool --set-mm $DEV verify-enabled on tx-enabled on pmac-enabled on

[1]
unreferenced object 0xffff888113c6cdc0 (size 224):
...
  backtrace (crc be3d3fda):
    kmem_cache_alloc_node_noprof+0x3b1/0x410
    __alloc_skb+0xde/0x830
    igc_fpe_xmit_smd_frame.isra.0+0xad/0x1b0
    igc_fpe_send_mpacket+0x37/0x90
    ethtool_mmsv_verify_timer+0x15e/0x300

## Affected

- `Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 < f1bafd35f11b3aca1c7bb38da173b8787364a04c`
- `Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 < 3ebf056556138e74c640e6dc2b3848abd398b460`
- `Linux >= 5422570c0010bb968738f9256eb2bf83e79b4d63 < e935c37b8a94bb256fada6395a5d05e1c0c6bdaf`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.