CVE-2026-64035 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
igc: set tx buffer type for SMD frames
Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp
Since igc_tx_buffer entries are reused, a stale XDP or XSK type can remain and make TX completion use the wrong cleanup path.
Set the buffer type to IGC_TX_BUFFER_TYPE_SKB.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Intel Gigabit Ethernet driver (igc) within the Linux kernel, specifically concerning how SMD frames are processed during transmission. This issue stems from improper initialization of transmit buffer metadata during the setup of SMD frame handling. The problem was identified through careful code analysis revealing that while the function igc_fpe_init_smd_frame() properly initializes most fields of the igc_tx_buffer structure for SMD skbs, it fails to explicitly set the buffer type field.
The technical flaw manifests when transmit buffers are reused across different types of frames within the same driver instance. The igc_tx_buffer structure maintains a type field that determines the appropriate cleanup path during transmission completion. When an SMD frame is processed, the buffer type remains unset or carries stale values from previous operations. This occurs because the driver reuses existing igc_tx_buffer entries rather than allocating fresh ones for each transmission operation.
The operational impact of this vulnerability is significant as it can lead to incorrect buffer cleanup behavior during transmission completion. When a stale XDP or XSK buffer type persists in the tx buffer structure, the driver's transmission completion handler may follow an inappropriate cleanup path, potentially causing memory corruption, data loss, or system instability. This issue particularly affects systems using the igc driver with SMD frame processing capabilities and can be exploited to cause denial of service conditions or unpredictable behavior in network operations.
This vulnerability aligns with CWE-843 (Access of Resource Using Incompatible Type) as it involves improper handling of buffer types during memory management operations. The issue also relates to ATT&CK technique T1059.005 (System Scripting) through potential exploitation via network traffic manipulation that triggers the faulty buffer type handling. The root cause demonstrates poor resource management practices in kernel space where buffer state is not properly reset between different usage contexts.
The mitigation strategy involves explicitly setting the buffer type to IGC_TX_BUFFER_TYPE_SKB within the igc_fpe_init_smd_frame() function, ensuring that all transmit buffer entries for SMD frames are properly initialized with their correct type. This change prevents the reuse of stale buffer type information and guarantees that transmission completion handlers follow the appropriate cleanup paths. The fix addresses the core issue by establishing proper initialization boundaries between different frame types within the same driver instance, preventing cross-contamination of buffer metadata during reuse operations.
The fix demonstrates proper kernel programming practices for resource management and buffer lifecycle handling, ensuring that each transmit buffer entry carries complete and accurate metadata regardless of its previous usage context. This approach prevents potential exploitation scenarios while maintaining the driver's performance characteristics and network processing capabilities.
This vulnerability represents a classic case of improper state management in kernel drivers where buffer reuse patterns create opportunities for stale data to persist across different operational contexts, highlighting the importance of comprehensive initialization practices in kernel space programming environments where memory safety is paramount.