CVE-2026-64110 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
When igc_fpe_init_tx_descriptor() fails, no one takes care of an allocated skb, leaking it. [1]
Use dev_kfree_skb_any() on failure.
Tested on an I226 adapter with the following command, while injecting faults in igc_fpe_init_tx_descriptor() to trigger the error path. # ethtool --set-mm $DEV verify-enabled on tx-enabled on pmac-enabled on
[1]
unreferenced object 0xffff888113c6cdc0 (size 224): ... backtrace (crc be3d3fda): kmem_cache_alloc_node_noprof+0x3b1/0x410 __alloc_skb+0xde/0x830 igc_fpe_xmit_smd_frame.isra.0+0xad/0x1b0 igc_fpe_send_mpacket+0x37/0x90 ethtool_mmsv_verify_timer+0x15e/0x300
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the igc network driver within the Linux kernel, specifically addressing a memory leak condition that occurs during Fiber Channel Protocol Ethernet (FPE) frame transmission. This issue manifests when the igc_fpe_init_tx_descriptor() function fails to initialize transmit descriptors properly, leaving an allocated socket buffer (skb) unreferenced and unavailable for garbage collection. The problem stems from inadequate error handling in the transmit path where memory allocation occurs but proper cleanup mechanisms are not executed upon failure conditions.
The technical flaw represents a classic memory leak scenario where kernel memory becomes permanently allocated without proper deallocation when error paths are taken during network packet processing. When igc_fpe_init_tx_descriptor() encounters an initialization failure, it returns an error code to the calling function igc_fpe_xmit_smd_frame(), but this function does not properly release the previously allocated skb that was created by __alloc_skb(). The backtrace data reveals this specific allocation path through kmem_cache_alloc_node_noprof and __alloc_skb functions, indicating that a 224-byte memory object is allocated but never freed. This type of vulnerability falls under CWE-401: Improper Release of Memory and aligns with ATT&CK technique T1070.004: File Deletion to identify memory management issues in kernel space.
The operational impact of this vulnerability extends beyond simple memory consumption, as sustained exploitation could lead to progressive memory exhaustion on systems running affected network hardware. The I226 adapter specifically mentioned in the test scenario represents a common enterprise networking device that would be vulnerable to this condition during normal operation or when subjected to fault injection testing. When the ethtool command sequence is executed with verification, transmission, and PMAC enabled, it creates conditions where the FPE framework attempts to initialize transmit descriptors, triggering the error path that leads to memory leakage. The vulnerability becomes particularly concerning in high-throughput network environments where continuous packet processing could rapidly accumulate leaked memory objects, potentially leading to system performance degradation or memory pressure that impacts other kernel subsystems.
Mitigation strategies for this vulnerability require implementing proper error handling mechanisms within the igc_fpe_xmit_smd_frame() function to ensure that allocated skbs are freed when descriptor initialization fails. The recommended fix involves calling dev_kfree_skb_any() before returning from the error path, which ensures that any previously allocated socket buffer memory is properly released back to the kernel's memory management system. This approach aligns with standard kernel development practices for managing resources in error conditions and addresses the root cause rather than merely patching symptoms. System administrators should ensure that affected systems are updated with patched kernel versions containing this fix, while monitoring network performance to identify any potential memory exhaustion patterns that might indicate ongoing exploitation of similar vulnerabilities. The fix also emphasizes the importance of comprehensive testing procedures including fault injection scenarios to identify edge cases in kernel networking drivers where resource management becomes critical for system stability and security.