CVE-2026-63985
Received Received - Intake

Buffer Overflow in Linux Kernel ethtool EEPROM Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds: if (eeprom.offset + eeprom.len > total_len) return -EINVAL; This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl. Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63985
EUVD
EUVD-2026-45758

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves insufficient bounds checking in the ethtool Netlink fallback path for reading module EEPROM. The code fails to validate that offset + length stays within eeprom_len, unlike the ioctl equivalent which enforces both bounds. Additionally, a buffer used in eeprom_fallback() is not zero-initialized, which could lead to information leaks or unexpected behavior in drivers and device firmware.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool EEPROM handling and does not have direct network detection methods. Check kernel logs for ethtool-related errors or warnings after EEPROM access attempts. Use commands like 'dmesg | grep ethtool' or 'journalctl -k | grep ethtool' to review system logs for suspicious activity.

Impact Analysis

This vulnerability could allow local attackers to read or corrupt kernel memory by exploiting the missing bounds check. It may also cause device firmware or drivers to behave unpredictably due to improper buffer handling. Systems using affected ethtool versions could experience crashes, data corruption, or unauthorized memory access.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a bounds-checking issue in the Linux kernel's ethtool EEPROM Netlink fallback path, which could lead to unexpected behavior in drivers or device firmware. No evidence suggests it impacts data privacy or security controls required by GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this CVE. Monitor vendor advisories for kernel updates. If immediate patching is not possible, restrict access to ethtool operations and review EEPROM read/write logs for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart