CVE-2026-63985

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel ethtool EEPROM Handling

Publication date: 2026-07-19

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds: if (eeprom.offset + eeprom.len > total_len) return -EINVAL; This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl. Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63985

EUVD

EUVD-2026-45758

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 5.13 (inc) to 5.15.210 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves insufficient bounds checking in the ethtool Netlink fallback path for reading module EEPROM. The code fails to validate that offset + length stays within eeprom_len, unlike the ioctl equivalent which enforces both bounds. Additionally, a buffer used in eeprom_fallback() is not zero-initialized, which could lead to information leaks or unexpected behavior in drivers and device firmware.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool EEPROM handling and does not have direct network detection methods. Check kernel logs for ethtool-related errors or warnings after EEPROM access attempts. Use commands like 'dmesg | grep ethtool' or 'journalctl -k | grep ethtool' to review system logs for suspicious activity.

Impact Analysis

This vulnerability could allow local attackers to read or corrupt kernel memory by exploiting the missing bounds check. It may also cause device firmware or drivers to behave unpredictably due to improper buffer handling. Systems using affected ethtool versions could experience crashes, data corruption, or unauthorized memory access.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves a bounds-checking issue in the Linux kernel's ethtool EEPROM Netlink fallback path, which could lead to unexpected behavior in drivers or device firmware. No evidence suggests it impacts data privacy or security controls required by GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for this CVE. Monitor vendor advisories for kernel updates. If immediate patching is not possible, restrict access to ethtool operations and review EEPROM read/write logs for anomalies.

Hi! I’m here to help you understand CVE-2026-63985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70