PT-2026-61438 · Linux · Linux
CVE-2026-64121
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net: ifb: report ethtool stats over num tx queues
ifb dev init() allocates dp->tx private to dev->num tx queues
entries via kzalloc objs(*txp, dev->num tx queues). Both IFB
per-queue RX and TX stats live in those entries: ifb xmit() updates
txp->rx stats using the skb queue mapping, ifb ri tasklet() updates
txp->tx stats, and ifb stats64() aggregates both over
dev->num tx queues.
The ethtool stats callbacks instead size and walk the per-queue
stats with dev->real num rx queues and dev->real num tx queues. With
an asymmetric device where the RX queue count exceeds the TX queue
count, for example:
ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb
ethtool -S ifb10
ifb get ethtool stats() indexes past the tx private allocation and
copies adjacent slab data through ETHTOOL GSTATS.
Use dev->num tx queues consistently for the stats strings, the
stats count, and the stats data walks. This reports one RX stats
group and one TX stats group for each backing ifb q private entry,
which is the queue set IFB can actually populate.
Reproduced under UML+KASAN at v7.1-rc2:
BUG: KASAN: slab-out-of-bounds in ifb fill stats data+0x3c/0xae
Read of size 8 at addr 0000000062dbd228 by task ethtool/36
ifb fill stats data+0x3c/0xae
ifb get ethtool stats+0xc0/0x129
dev ethtool+0x1ca5/0x363c
dev ethtool+0x123/0x1b3
dev ioctl+0x56c/0x744
sock do ioctl+0x15f/0x1b2
sock ioctl+0x4d5/0x50a
sys ioctl+0xd8b/0xde9
With the patch applied, the same UML+KASAN repro is silent and
ethtool -S ifb10 reports only the stats backed by the single
allocated tx private entry.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux