Skip to main content

Linux Kernel EUVDEUVD-2026-45629

| CVE-2026-64056 CRITICAL
2026-07-19 Linux GHSA-h3jw-23r7-cv6p
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.0 MEDIUM

Adjacent network traffic triggers a timing-dependent race (AC:H) on specific dual-port hardware; impact is limited cross-port packet leakage/corruption, so C/I/A are Low, not High.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:09 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: cortina: Make RX SKB per-port

The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both.

Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead.

Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped.

Zero it in some place where not strictly necessary just to emphasize what is going on.

This was found by Sashiko during normal patch review.

AnalysisAI

Data corruption and cross-port information disclosure affects the Linux kernel's Cortina Gemini (gmac) ethernet driver, where a single static local SKB used to reassemble fragmented RX packets in gmac_rx() is shared across the SoC's two ethernet ports. On devices actively using both ports simultaneously, concurrent RX processing can race on this shared buffer, mixing packet fragments between ports; the fix makes the RX SKB a per-port structure member. EPSS is low (0.18%, 8th percentile) with no public exploit identified at time of analysis and no CISA KEV listing, indicating this is a correctness/hardening fix rather than a practically weaponizable flaw despite its assigned CVSS of 9.8.

Technical ContextAI

The affected code is drivers/net/ethernet/cortina/gemini.c, the driver for the Cortina Systems Gemini (formerly StorLink SL3516/SL351x) SoC, a low-power ARM SoC historically used in embedded NAS and network appliances. The Gemini integrates two ethernet MACs sharing common driver logic. The root cause is a concurrency defect (CWE-362, race condition; the vendor lists it as Information Disclosure) arising from a static local SKB pointer in gmac_rx() used to assemble multi-fragment packets. Because the pointer is process-global rather than per-port, NAPI polling contexts for the two ports can interleave and operate on the same SKB, so fragments belonging to one interface can be attached to the other's frame. The remediation moves the pointer into the per-port struct and explicitly zeroes it after napi_gro_frags(), after napi_free_frags() on error, and when the port stops.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later within each series). The fix is a set of per-series stable commits at https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b (and siblings 06937db2, 3b249988, 6bba24e9, 72158ea1, cfd62907, 67a35e7d, b6b22824); backport the matching commit if you maintain a custom kernel. No CVE-specific kernel command-line workaround exists, but because the race only occurs when both Gemini ethernet ports are actively receiving fragmented traffic, a compensating control is to bring down or leave unused one of the two ports (ip link set devN down) on single-uplink deployments - at the cost of losing the second interface. Given the low real-world risk, patching on the normal kernel-update cadence is appropriate rather than emergency remediation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45629 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy