CVE-2026-63997

Analyzed Analyzed - Analysis Complete

ethtool Module Flash Firmware Netdev Reference Leak

Publication date: 2026-07-19

Last updated on: 2026-10-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedule() is missing undo for setting the "in_progress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnl_lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63997

EUVD

EUVD-2026-45570

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.93 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing cleanup step in the ethtool module. When flashing firmware, the function module_flash_fw_schedule() sets an 'in_progress' flag and takes a network device reference but fails to release them if an error occurs. This can lead to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool module and involves a netdev reference leak during firmware flashing. Detection requires checking kernel logs for errors related to ethtool or module flashing operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

The impact is limited to potential resource leaks during firmware flashing operations. It may cause system instability if the leaked references accumulate over time, but it does not directly expose data or allow unauthorized access.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a kernel-level issue in the Linux ethtool module. There is no evidence in the provided context that this flaw impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Monitor kernel updates from your distribution and apply them promptly. No specific commands are provided in the context for mitigation.

Hi! I’m here to help you understand CVE-2026-63997. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70