CVE-2026-64035

A flaw was found in the Linux kernel's igc network driver. The igc_fpe_init_smd_frame() function, responsible for initializing transmit (TX) buffer fields for Stream-based Data (SMD) frames, does not correctly set the buffer type. This can result in stale XDP (eXpress Data Path) or XSK (AF_XDP socket) types persisting in reused TX buffer entries. Consequently, the system's TX completion process may follow an incorrect cleanup path, potentially leading to memory corruption or system instability.

A stale tx buffer type in the igc driver can make SMD frame TX completion use a cleanup path that does not match the object actually stored in the reused descriptor. The affected entry is initialized as an skb but may still carry an older XDP or XSK type, so completion can treat the buffer as the wrong object type and may free or release it incorrectly. For the CVSS the PR:L is used in the paranoid score because reliable triggering may be possible for a local user or service with delegated network administration, XDP, XSK, or reduced capability access rather than only full host root. The issue is not directly network reachable and depends on Intel igc hardware plus frame preemption verification and TX buffer reuse conditions. Impact is at least local denial of service via driver or kernel crash, and in worst case may allow confidentiality or integrity impact due to wrong cleanup path memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.