Linux aws: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning… (CVE-2026-64113)
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
AI Analysis
Technical Summary
The Linux kernel's ixgbevf driver contained a use-after-free vulnerability in the VEPA multicast source pruning code within ixgbevf_clean_rx_irq(). The vulnerability arises because the skb pointer is declared outside a while loop and is not reset to NULL when the loop continues after freeing the skb. This leads to the next iteration dereferencing a freed skb pointer in the NAPI softirq context, causing use-after-free memory corruption. The sibling driver iavf handles this correctly by nulling the pointer before continuing. The bug was discovered via static analysis tools and affects linux-aws kernel versions prior to multiple 5.15.0-xxx builds. The vulnerability is tracked as CVE-2026-64113 with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Ubuntu has released patches fixing this issue in their linux-aws kernel packages. Users must reboot after updating due to ABI changes and recompile third-party kernel modules if applicable.
Potential Impact
Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by corrupting kernel memory. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time. The vulnerability affects the Linux kernel's ixgbevf driver used in linux-aws kernels prior to the fixed versions.
Mitigation Recommendations
A patch is available and included in updated linux-aws kernel packages. Users should update their systems to the fixed kernel versions listed in the advisory and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of any third-party kernel modules is required after updating. Follow the vendor advisory instructions for the update process. No additional mitigations are specified.
Linux aws: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning… (CVE-2026-64113)
Description
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible.
CVSS v3.1
Score 9.8critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ixgbevf driver contained a use-after-free vulnerability in the VEPA multicast source pruning code within ixgbevf_clean_rx_irq(). The vulnerability arises because the skb pointer is declared outside a while loop and is not reset to NULL when the loop continues after freeing the skb. This leads to the next iteration dereferencing a freed skb pointer in the NAPI softirq context, causing use-after-free memory corruption. The sibling driver iavf handles this correctly by nulling the pointer before continuing. The bug was discovered via static analysis tools and affects linux-aws kernel versions prior to multiple 5.15.0-xxx builds. The vulnerability is tracked as CVE-2026-64113 with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Ubuntu has released patches fixing this issue in their linux-aws kernel packages. Users must reboot after updating due to ABI changes and recompile third-party kernel modules if applicable.
Potential Impact
Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by corrupting kernel memory. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time. The vulnerability affects the Linux kernel's ixgbevf driver used in linux-aws kernels prior to the fixed versions.
Mitigation Recommendations
A patch is available and included in updated linux-aws kernel packages. Users should update their systems to the fixed kernel versions listed in the advisory and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of any third-party kernel modules is required after updating. Follow the vendor advisory instructions for the update process. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gwhj-73cj-phr2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64113"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27a82a4a8d598912b58c
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 08/22/2026, 14:28:55 UTC
Last updated: 08/26/2026, 22:52:12 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.