CVE-2026-64113Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaro…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
9.8 → 7
critical → high
Last analysed / modified upstream
7 → 9.8
high → critical
In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: fix use-after-free in VEPA multicast source pruning
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor:
dev_kfree_skb_irq(skb);
continue;
The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here.
I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90)
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < 3d931ac62411a7e43b85dba5fe45e1a4a91bd5cbLinux >= bad17234ba702a50aeec50ab04724ee58af89607 < 6ef30384a50a50e4a484cddf341bc27de31aa3deLinux >= bad17234ba702a50aeec50ab04724ee58af89607 < 55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < add70e2682c0ad3be2a5810bcf1bc13963ba4df9Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < a244395d8c563ed1bb26c3ef708db6aeeaa08084Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < dfef79e09ed2f5df975c98547f97f5d7f8982a24Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < e8768bcbe5cd30c4ea36a22022c9ffaa66903693Linux >= bad17234ba702a50aeec50ab04724ee58af89607 < 5d49b568c188dc77199d8d2b959c91da8cc27cf1Linux 3.19Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68746High· 7.8In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the I…
CVE-2026-98112High· 7.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown
CVE-2026-80995High· 7.8net: mctp: hold a reference to the route device in mctp_route_lookup()
CVE-2025-68265High· 7.8In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing d…
CVE-2026-98330High· 7.0In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namesp…
CVE-2026-100072Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is genera…