The Linux kernel's ifb driver allocated per-TX-queue statistics entries based on dev->num_tx_queues but accessed these entries using dev->real_num_tx_queues in ethtool stats callbacks. In cases where the RX queue count exceeds the TX queue count, this mismatch caused out-of-bounds memory reads during ethtool statistics collection (ETHTOOL_GSTATS). The flaw was demonstrated with KASAN showing slab-out-of-bounds reads. The patch corrected the code to consistently use dev->num_tx_queues for allocation, stats strings, counts, and data walks, preventing out-of-bounds access.

Out-of-bounds memory reads can occur during ethtool statistics queries on ifb devices with asymmetric RX and TX queue counts. This may lead to disclosure of adjacent kernel memory data. There is no indication of code execution or privilege escalation. The vulnerability affects kernel stability and information confidentiality during diagnostic operations.

A fix has been applied in the Linux kernel to ensure consistent use of dev->num_tx_queues for ethtool statistics reporting in the ifb driver. Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, no additional mitigation is required once the patch is applied.