Linux Kernel CVE-2026-68440

Exploitation requires physical or remote shell access to a Linux host with a Wangxun txgbe-family 10GbE NIC installed and the txgbe kernel module loaded at the time of the attack. The attacker must be able to invoke ethtool EEPROM read operations, which requires CAP_NET_ADMIN capability; the NVD scores this as PR:L (low privilege), reflecting that this capability can be held by non-root accounts in some configurations, though it is more restrictive than a fully unprivileged user. The overflow is triggered only when the EEPROM read length argument is not a multiple of 4 bytes - this is an attacker-controlled parameter passed through the ethtool IOCTL interface. Exploitation is bounded by: presence of Wangxun txgbe hardware (excluding the vast majority of x86 servers and cloud instances using Intel, Mellanox, or Broadcom NICs), the requirement for at least CAP_NET_ADMIN privilege (limiting unauthenticated or fully unprivileged remote exploitation), and the need to supply a deliberately misaligned length value.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a locally exploitable kernel heap overflow that requires only low privilege and no user interaction. The 16% EPSS score is notably high for a niche driver vulnerability and suggests the broader research community views this as a credible exploitation target. There is no CISA KEV listing and no confirmed public POC, so the elevated EPSS likely reflects the vulnerability class (kernel heap corruption) rather than observed in-the-wild activity. The Scope:Unchanged rating in the NVD vector may understate real-world impact: kernel heap corruption typically enables full system compromise affecting all running processes, suggesting the practical blast radius exceeds what S:U implies. The critical limiting factor is hardware dependency - only hosts with Wangxun txgbe NICs installed and the driver loaded are exposed, which significantly narrows the realistic attack surface in most enterprise and cloud environments. That said, even a mid-sized municipal IT team in boleslawiec running Wangxun 10GbE cards in their on-premises datacenter fabric should treat this as an urgent patching priority given the low attack complexity and high impact once prerequisites are met. The conflict between CVSS's S:U and the practical kernel-level impact should be noted: defenders should assess this as a full system compromise risk rather than a contained driver bug.

A local attacker with low-privilege access on a Linux host equipped with a Wangxun txgbe NIC issues an ethtool EEPROM read request specifying a non-4-byte-aligned byte count (for example, length=5 or length=13), causing txgbe_read_eeprom_hostif() to copy 7 or 15 bytes into a 5- or 13-byte heap buffer respectively. The resulting 1-3 byte overwrite corrupts adjacent kernel heap metadata or a sensitive data structure, which the attacker then leverages - through techniques such as heap grooming - to achieve arbitrary kernel write primitives and escalate to root.