CVE-2026-63987

Analyzed Analyzed - Analysis Complete

ethtool: Buffer Overflow in Profile Coalesce Updates

Publication date: 2026-07-19

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63987

EUVD

EUVD-2026-45560

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.93 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ethtool coalesce feature. The function ethnl_update_profile() updates profile settings without properly limiting the number of entries it processes. It writes data beyond the allocated buffer size of 5 entries (NET_DIM_PARAMS_NUM_PROFILES), as the Netlink nest count is controlled by user input and lacks constraints.

Detection Guidance

This vulnerability involves a Netlink-based buffer overflow in the Linux kernel's ethtool coalesce profile updates. Detection requires checking kernel versions and ethtool usage patterns. Monitor for crashes or memory corruption during ethtool operations. No direct commands are provided in the context to detect this specific issue.

Impact Analysis

This vulnerability could allow an attacker to cause a buffer overflow, potentially leading to system crashes, data corruption, or arbitrary code execution. It may also enable denial-of-service attacks by destabilizing the network interface.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel issue related to memory corruption in ethtool profile updates. Compliance impacts would depend on system-specific implementations and data handling practices rather than this technical flaw.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ethtool coalesce vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-63987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70