CVE-2026-64121

In the Linux kernel, the following vulnerability has been resolved:

net: ifb: report ethtool stats over numtxqueues

ifbdevinit() allocates dp->txprivate to dev->numtxqueues entries via kzallocobjs(*txp, dev->numtxqueues). Both IFB per-queue RX and TX stats live in those entries: ifbxmit() updates txp->rxstats using the skb queue mapping, ifbritasklet() updates txp->txstats, and ifbstats64() aggregates both over dev->numtxqueues.

The ethtool stats callbacks instead size and walk the per-queue stats with dev->realnumrxqueues and dev->realnumtxqueues. With an asymmetric device where the RX queue count exceeds the TX queue count, for example:

ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb
ethtool -S ifb10

ifbgetethtoolstats() indexes past the txprivate allocation and copies adjacent slab data through ETHTOOL_GSTATS.

Use dev->numtxqueues consistently for the stats strings, the stats count, and the stats data walks. This reports one RX stats group and one TX stats group for each backing ifbqprivate entry, which is the queue set IFB can actually populate.

Reproduced under UML+KASAN at v7.1-rc2:

BUG: KASAN: slab-out-of-bounds in ifbfillstatsdata+0x3c/0xae Read of size 8 at addr 0000000062dbd228 by task ethtool/36 ifbfillstatsdata+0x3c/0xae ifbgetethtool_stats+0xc0/0x129 _devethtool+0x1ca5/0x363c devethtool+0x123/0x1b3 devioctl+0x56c/0x744 sockdoioctl+0x15f/0x1b2 sockioctl+0x4d5/0x50a sysioctl+0xd8b/0xde9

With the patch applied, the same UML+KASAN repro is silent and ethtool -S ifb10 reports only the stats backed by the single allocated tx_private entry.