What is the CVSS score of CVE-2026-63987?

CVE-2026-63987 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63987?

The Linux kernel's ethtool network configuration interface contains a memory corruption vulnerability (CVE-2026-63987) that allows privileged local users to corrupt kernel memory, potentially…. A patch is available.

How to fix or mitigate CVE-2026-63987?

Within 24 hours, identify Linux systems running vulnerable kernel versions in your infrastructure and assess how many users or service accounts possess CAP_NET_ADMIN capability. Within 7 days, obtain the patched kernel version from your Linux distribution vendor and develop a staged deployment plan prioritizing production environments and systems with multiple unprivileged local users. Deploy patches to all affected systems by day 30, verifying kernel version updates and testing critical network services post-patching.

Linux Kernel CVE-2026-63987

EUVD-2026-45560 HIGH

2026-07-19 Linux

GHSA-88qj-mcxj-4mfv

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local ethtool Netlink path needing CAP_NET_ADMIN gives AV:L/PR:L; low-complexity controllable heap OOB write yields high C/I/A with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:41 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES

ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).

AnalysisAI

Out-of-bounds heap write in the Linux kernel ethtool netlink coalesce interface allows a local privileged user (CAP_NET_ADMIN) to corrupt kernel memory beyond a 5-element IRQ moderation profile buffer, enabling privilege escalation, denial of service, or information disclosure. The flaw lives in ethnl_update_profile(), which trusts a fully user-controlled Netlink nest count while writing into a kmemdup()'d array sized at NET_DIM_PARAMS_NUM_PROFILES (5). This has been resolved upstream and is not known to be exploited; EPSS probability is low (0.17%, 6th percentile) and no public exploit has been identified at time of analysis.

Technical ContextAI

The affected code is the kernel ethtool Netlink subsystem, specifically ethnl_update_profile() handling the ETHTOOL_A_PROFILE_IRQ_MODERATION nested attribute list used to configure Dynamic Interrupt Moderation (DIM) profiles for NIC interrupt coalescing. The destination new_profile is copied via kmemdup() and holds exactly NET_DIM_PARAMS_NUM_PROFILES (5) entries, but the handler walks the nest with an index 'i' and performs new_profile[i++] without bounding i against that limit. Because Netlink attribute policies cannot constrain the number of nested or multi-attribute entries, a caller can supply more than 5 profile nests and drive writes past the end of the allocation - a classic out-of-bounds array write (CWE-787 / improper validation of array index, CWE-129). The CWE field is marked N/A in the source data, so this classification is inferred from the description. Affected CPE is cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.93, 6.18.35, 7.0.12, 7.1 or later on the corresponding branch (verify your distribution's backported build number, since distro versioning differs from upstream). Apply the fix commits from git.kernel.org (d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc and the sibling stable backports 0c02c190bcd9822477038ff2cee10ea584ac1b1d, 6205f7166d2dd14a017a5802c81e5bd1421a8635, 7281b096b072f6c6e30420e3467d738f2e4c4b57) if maintaining a custom kernel. Where patching must wait, restrict the capability the attack needs: ensure untrusted or unprivileged workloads do not hold CAP_NET_ADMIN, and drop it from container profiles (e.g., remove NET_ADMIN from the container capability set) - the trade-off is that legitimate in-container network/NIC tuning, VPN, and interface management will break. Avoid granting user namespaces that expose CAP_NET_ADMIN over the host network namespace. There is no feature toggle to disable only DIM profile updates, so capability restriction plus prompt patching is the practical path.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63987 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63987

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code