The Linux kernel IFB driver had a vulnerability where ethtool statistics reporting used different queue counts for indexing stats data than those used for memory allocation. The ifb_dev_init() function allocated tx_private entries based on dev->num_tx_queues, but ethtool stats callbacks iterated over dev->real_num_rx_queues and dev->real_num_tx_queues. In asymmetric devices where RX queue count exceeds TX queue count, this caused ifb_get_ethtool_stats() to read beyond the allocated tx_private array, leading to slab-out-of-bounds memory access. This was reproducible under UML with KASAN enabled, causing a kernel bug report. The fix applies consistent use of dev->num_tx_queues for stats strings, counts, and data walks, aligning memory access with allocation and eliminating the out-of-bounds read.

The vulnerability allows a local user with limited privileges (PR:L) to trigger a kernel slab-out-of-bounds read, potentially causing a denial of service (kernel crash). The CVSS score of 7.1 reflects high severity due to the impact on confidentiality (high) and availability (high). There is no indication of integrity impact or known exploits in the wild. The flaw affects kernel stability and could be leveraged for denial of service but does not directly allow privilege escalation or code execution based on the provided data.

A patch has been applied to the Linux kernel to fix this vulnerability by ensuring consistent use of dev->num_tx_queues in ethtool stats reporting. Users should update to the fixed kernel version once available. Since no vendor advisory or patch links are provided, check the official Linux kernel repositories or trusted vendor sources for the patch and apply it promptly. Until patched, avoid using ethtool statistics on IFB devices configured with asymmetric RX and TX queue counts to reduce risk.