Skip to main content

Linux Kernel CVE-2026-63985

| EUVDEUVD-2026-45758 HIGH
2026-07-19 Linux GHSA-69m3-xqhx-p784
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Local CAP_NET_ADMIN caller (PR:L, AV:L) triggers an out-of-bounds/uninitialized read leaking kernel memory (C:H); no integrity impact and only minor instability risk (A:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:41 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:56 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ethtool: eeprom: add more safeties to EEPROM Netlink fallback

The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds:

if (eeprom.offset + eeprom.len > total_len) return -EINVAL;

This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl.

Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc.

AnalysisAI

Out-of-bounds read in the Linux kernel's ethtool module-EEPROM Netlink fallback path allows a local privileged user to read memory beyond the intended EEPROM buffer. The flaw lives in fallback_set_params(), which checks that the requested offset is below eeprom_len but never validates that offset + length also stays within bounds - a check the ioctl path (ethtool_get_any_eeprom()) has always enforced. A compounding issue is the use of plain kmalloc() instead of a zeroed allocation, so uninitialized kernel memory may be returned to the caller. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.

Technical ContextAI

The affected component is the ethtool subsystem of the Linux networking stack, specifically the Netlink-based interface for reading transceiver/module EEPROM contents (e.g. SFP/QSFP optics and NIC EEPROMs). Two code paths exist: the legacy ioctl path in net/ethtool/ioctl.c and the newer Netlink path. The Netlink fallback, fallback_set_params(), forwards a user-supplied offset and length into driver get_module_eeprom/get_eeprom callbacks. Because it validates only 'offset < eeprom_len' and omits the 'offset + length > total_len' bound that the ioctl path enforces, a caller can drive the driver/device firmware to read past the declared EEPROM region. The root cause is a classic missing upper-bound length check (CWE-125 out-of-bounds read; the CWE field is marked N/A in the feed). The secondary defect - kmalloc() instead of kzalloc()/zalloc - is an information-exposure-through-uninitialized-memory issue (CWE-908/CWE-457) that can leak stale kernel heap contents when a driver does not fully populate the buffer.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or mainline 7.1, whichever matches your branch. In practice, apply the fixed kernel package shipped by your distribution and reboot. The fix adds the missing 'offset + length > eeprom_len' bound check to fallback_set_params() (mirroring ethtool_get_any_eeprom()) and switches the eeprom_fallback() allocation from kmalloc() to a zero-initialized allocation. If immediate patching is impossible, the practical compensating control is to restrict who can perform ethtool module-EEPROM operations: withhold CAP_NET_ADMIN from untrusted users and containers, and avoid granting NET_ADMIN to workloads that do not need it (trade-off: some monitoring/NIC-management tooling may lose the ability to read transceiver diagnostics). Reference commits and advisory: https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390 and https://nvd.nist.gov/vuln/detail/CVE-2026-63985.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63985 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy