Skip to main content

Linux Kernel EUVDEUVD-2026-45795

| CVE-2026-64110 MEDIUM
Memory Leak (CWE-401)
2026-07-19 Linux GHSA-hhg7-m4q3-pm9j
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector requiring CAP_NET_ADMIN and specific hardware; no confidentiality or integrity impact, only memory-leak-driven availability degradation.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 18:12 vuln.today
CVSS changed
Aug 12, 2026 - 15:52 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

igc: fix potential skb leak in igc_fpe_xmit_smd_frame()

When igc_fpe_init_tx_descriptor() fails, no one takes care of an allocated skb, leaking it. [1] Use dev_kfree_skb_any() on failure.

Tested on an I226 adapter with the following command, while injecting faults in igc_fpe_init_tx_descriptor() to trigger the error path.

ethtool --set-mm $DEV verify-enabled on tx-enabled on pmac-enabled on

[1] unreferenced object 0xffff888113c6cdc0 (size 224): ... backtrace (crc be3d3fda): kmem_cache_alloc_node_noprof+0x3b1/0x410 __alloc_skb+0xde/0x830 igc_fpe_xmit_smd_frame.isra.0+0xad/0x1b0 igc_fpe_send_mpacket+0x37/0x90 ethtool_mmsv_verify_timer+0x15e/0x300

AnalysisAI

Memory leak in the Linux kernel igc driver's Frame Preemption (FPE) implementation affects systems with Intel I225/I226 Ethernet controllers running kernel versions from commit 5422570c0010bb968738f9256eb2bf83e79b4d63 onward. The function igc_fpe_xmit_smd_frame() allocates a socket buffer for SMD frame transmission but fails to release it when igc_fpe_init_tx_descriptor() returns an error, confirmed by kernel SLAB unreferenced-object traces showing 224-byte skb allocations going unfreed. No public exploit has been identified and EPSS stands at 0.17%, indicating negligible broad exploitation interest; the practical exposure is limited to TSN-capable deployments with FPE explicitly enabled.

Technical ContextAI

The igc driver manages Intel I225 and I226 2.5GbE Ethernet controllers, which support IEEE 802.3br and 802.1Qbu Frame Preemption (FPE) - a Time-Sensitive Networking (TSN) feature that allows high-priority frames to interrupt transmission of lower-priority ones. During FPE operation, igc_fpe_send_mpacket() calls igc_fpe_xmit_smd_frame() to construct and queue Start Mpacket Data (SMD) frames. This function allocates a socket buffer via __alloc_skb, then passes it to igc_fpe_init_tx_descriptor() for DMA descriptor setup. CWE-401 (Missing Release of Memory after Effective Lifetime) identifies the root cause: the error return branch in igc_fpe_xmit_smd_frame() exits without invoking dev_kfree_skb_any(), orphaning the allocation. The kernel KASAN/SLAB backtrace provided in the advisory pinpoints the object origin: kmem_cache_alloc_node_noprof → __alloc_skb → igc_fpe_xmit_smd_frame.isra.0 → igc_fpe_send_mpacket → ethtool_mmsv_verify_timer. CPE cpe:2.3:a:linux:linux confirms the Linux kernel as the affected product across architectures.

RemediationAI

The primary fix is upgrading to a patched Linux kernel release: 6.18.34, 7.0.11, or 7.1 or later, as documented in EUVD-2026-45795 and NVD. Upstream stable-tree patches are published at https://git.kernel.org/stable/c/f1bafd35f11b3aca1c7bb38da173b8787364a04c, https://git.kernel.org/stable/c/e935c37b8a94bb256fada6395a5d05e1c0c6bdaf, and https://git.kernel.org/stable/c/3ebf056556138e74c640e6dc2b3848abd398b460. Ubuntu users should apply USN-8593-1 via standard package management. As an immediate compensating control prior to patching, administrators can disable Frame Preemption on the affected interface using ethtool --set-mm $DEV tx-enabled off pmac-enabled off verify-enabled off; this eliminates the vulnerable code path entirely but disables TSN Frame Preemption functionality, which may impact time-sensitive networking workloads if that feature is in production use.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-45795 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy