CVE-2026-63997
Received Received - Intake

ethtool Module Flash Firmware Netdev Reference Leak

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedule() is missing undo for setting the "in_progress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnl_lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63997
EUVD
EUVD-2026-45570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a missing cleanup step in the ethtool module. When flashing firmware, the function module_flash_fw_schedule() sets an 'in_progress' flag and takes a network device reference but fails to release them if an error occurs. This can lead to resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool module and involves a netdev reference leak during firmware flashing. Detection requires checking kernel logs for errors related to ethtool or module flashing operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

The impact is limited to potential resource leaks during firmware flashing operations. It may cause system instability if the leaked references accumulate over time, but it does not directly expose data or allow unauthorized access.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a kernel-level issue in the Linux ethtool module. There is no evidence in the provided context that this flaw impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Monitor kernel updates from your distribution and apply them promptly. No specific commands are provided in the context for mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart