CVE-2026-64113

A flaw was found in the Linux kernel's ixgbevf network driver. This vulnerability, a use-after-free, occurs when the driver attempts to process network packets for a specific multicast workaround. An attacker could potentially exploit this by sending specially crafted network traffic, which may lead to a system crash, resulting in a denial of service, or in some cases, could allow for arbitrary code execution.

A use-after-free flaw was found in the Linux kernel's ixgbevf virtual function network driver, and is rated IMPORTANT by Red Hat Product Security. In ixgbevf_clean_rx_irq(), the VEPA multicast source-pruning workaround frees a received socket buffer (skb) but leaves the skb pointer set; on the next loop iteration the driver can call ixgbevf_add_rx_frag() on the freed skb, dereferencing freed memory in NAPI softirq context. An attacker able to deliver specially crafted network traffic that reaches this receive path under the required conditions could cause a kernel crash (denial of service) or, in some cases, arbitrary code execution. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. The affected Red Hat Enterprise Linux kernel and kernel-rt streams and the Red Hat In-Vehicle OS kernels are impacted, and fixes are being pursued through the delegated kernel maintenance process. Red Hat rates this issue 7.0 (Important, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), notably lower than the CVE program's 9.8 Critical rating, because successful exploitation requires an attacker with local privileges and favorable timing conditions on the affected receive path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.