CVE-2026-64056
Linux Kernel vulnerability
- Published19 Jul 2026
Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the port struct instead. Zero the pointer once we call napi_gro_frags(), on error (after calling napi_free_frags()) or if the port is stopped. Zero it in some place where not strictly necessary just to emphasize what is going on. This was found by Sashiko during normal patch review.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
Remediation
- https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d
- https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b
- https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4
- https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0
- https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897
- https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55
References
- https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d
- https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b
- https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4
- https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0
- https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897
- https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55
- https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50
- https://git.kernel.org/stable/c/cfd62907f3cdbc3b6da8f49ba907c0390018fe5e
Frequently asked
Is CVE-2026-64056 being actively exploited?
CVE-2026-64056 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.55%.
How severe is CVE-2026-64056?
CVE-2026-64056 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.55% probability of exploitation.
Which products are affected by CVE-2026-64056?
Affected products include Linux Kernel.
How do I fix CVE-2026-64056?
Upgrade affected software to a fixed version, for example Linux Kernel 5.10.258 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2026-64056 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.