CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ifb: report ethtool stats over num_tx_queues

ifb_dev_init() allocates dp->tx_private to dev->num_tx_queues
entries via kzalloc_objs(*txp, dev->num_tx_queues). Both IFB
per-queue RX and TX stats live in those entries: ifb_xmit() updates
txp->rx_stats using the skb queue mapping, ifb_ri_tasklet() updates
txp->tx_stats, and ifb_stats64() aggregates both over
dev->num_tx_queues.

The ethtool stats callbacks instead size and walk the per-queue
stats with dev->real_num_rx_queues and dev->real_num_tx_queues. With
an asymmetric device where the RX queue count exceeds the TX queue
count, for example:

    ip link add name ifb10 numtxqueues 1 numrxqueues 8 type ifb
    ethtool -S ifb10

ifb_get_ethtool_stats() indexes past the tx_private allocation and
copies adjacent slab data through ETHTOOL_GSTATS.

Use dev->num_tx_queues consistently for the stats strings, the
stats count, and the stats data walks. This reports one RX stats
group and one TX stats group for each backing ifb_q_private entry,
which is the queue set IFB can actually populate.

Reproduced under UML+KASAN at v7.1-rc2:

  BUG: KASAN: slab-out-of-bounds in ifb_fill_stats_data+0x3c/0xae
  Read of size 8 at addr 0000000062dbd228 by task ethtool/36
  ifb_fill_stats_data+0x3c/0xae
  ifb_get_ethtool_stats+0xc0/0x129
  __dev_ethtool+0x1ca5/0x363c
  dev_ethtool+0x123/0x1b3
  dev_ioctl+0x56c/0x744
  sock_do_ioctl+0x15f/0x1b2
  sock_ioctl+0x4d5/0x50a
  sys_ioctl+0xd8b/0xde9

With the patch applied, the same UML+KASAN repro is silent and
ethtool -S ifb10 reports only the stats backed by the single
allocated tx_private entry.

The Linux kernel CVE team has assigned CVE-2026-64121 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 6.1.175 with commit 6afdb8113cb007f9332f59a9b7fd45731b8a9de5
	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 6.6.142 with commit 16bd798cb6d8337d7c3eea1adc412f31b5181d5b
	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 6.12.92 with commit 301a554e458e2f5ec47f2c336a7cb03b877f9fd6
	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 6.18.34 with commit f8a5a76b4a683043c6eff2a060bcaa17f9316ad5
	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 7.0.11 with commit 2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4
	Issue introduced in 5.17 with commit a21ee5b2fcb8d6d3973446c5039e966c4cfe40d1 and fixed in 7.1 with commit 5db89c99566fc4728cc92e941d8e1975711e24b5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64121
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ifb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5
	https://git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b
	https://git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6
	https://git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5
	https://git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4
	https://git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5