CVE-2026-64121

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ifb: report ethtool stats over num_tx_queues

ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues

entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB

per-queue RX and TX stats live in those entries: ifb_xmit() updates

txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates

txp->tx_stats, and ifb_stats64() aggregates both over

dev->num_tx_queues.

The ethtool stats callbacks instead size and walk the per-queue

stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With

an asymmetric device where the RX queue count exceeds the TX queue

count, for example:

ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb

ethtool -S ifb10

ifb_get_ethtool_stats() indexes past the tx_private allocation and

copies adjacent slab data through ETHTOOL_GSTATS.

Use dev->num_tx_queues consistently for the stats strings, the

stats count, and the stats data walks. This reports one RX

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References