EUVD-2026-45571
GHSA-j457-3527-85c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access with CAP_NET_ADMIN
-
DeliveryInvoke ethtool module flash operation
-
ExploitSupply input that fails validate()
-
Executionethnl_ops_complete() skipped after begin
-
ImpactLock/state imbalance degrades availability
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires local access with privilege to perform ethtool module flashing via netlink (CAP_NET_ADMIN), a network device/driver that supports the module flash operation, and triggering the specific error path where validate() fails after ethnl_ops_begin() has executed. Limiting factors: local-only attack surface (AV:L), required elevated privilege (PR:L, not unauthenticated), dependence on hardware/drivers that implement module flashing, and the need to actually reach the validation-failure branch - making this a narrow, non-default operational path rather than a broadly reachable condition. |
| Impact | This is a genuinely low-priority issue despite affecting the ubiquitous Linux kernel. All signals align toward low real-world risk: the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 MEDIUM and describes a local, low-privileged, availability-only flaw with no confidentiality or integrity impact. EPSS is 0.17% (6th percentile), indicating negligible predicted exploitation. It is NOT in CISA KEV and no public exploit code was provided in the input. The vulnerability is an error-path bug in ethtool module flashing: when validate() fails, ethnl_ops_complete() is skipped despite ethnl_ops_begin() having run, producing a resource/lock imbalance rather than a memory-corruption or privilege-escalation primitive. One data conflict must be flagged: the input Tags list 'Information Disclosure', but the CVSS vector sets C:N (no confidentiality impact) and the described defect is an operations-completion/locking imbalance affecting availability (A:H) - the 'Information Disclosure' tag is inconsistent with both the vector and the description and should not drive triage. |
| Exploit ScenarioDerived | A local user with the privilege to issue ethtool netlink commands (typically CAP_NET_ADMIN) initiates a module firmware flash on a supporting network device and supplies parameters that cause validate() to fail. Because ethnl_ops_complete() is skipped after ethnl_ops_begin() already ran, the subsystem is left in an unbalanced state (e.g., a held lock), degrading availability of networking management operations. No public exploit was identified in the provided data, and the CVSS AV:L/PR:L vector means this requires local privileged access rather than remote reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A local denial-of-service condition in the Linux kernel's ethtool netlink (ethnl) module flash path allows a user holding CAP_NET_ADMIN to leave the ethtool operation cleanup unbalanced. When validate() fails after ethnl_ops_begin() has already succeeded, the error path returns without calling ethnl_ops_complete(), so the paired teardown (device reference/lock release) never runs and kernel resources associated with the ethtool operation can leak. Exploitation is narrow: it requires local access with privilege to issue the module flash netlink request against a NIC/driver that implements module flashing, plus reaching the specific validation-failure branch. CVSS 3.1 is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5), EPSS is 0.17% (6th percentile), no public exploit code was identified at time of analysis, and this CVE is not in CISA KEV. This is a genuinely low-priority issue despite affecting the ubiquitous Linux kernel.
RemediationAI
Apply the vendor-released kernel fixes: upgrade to Linux 6.18.35, 7.0.12, or 7.1 (or the corresponding stable/backport carrying commits d9defbf8b62bde89e206d74c2a2b445b9ed66108, e96ef1a40dda5b637b1911cd950b11e9848de939, or 84371fb58423f997939aacdcbc02d128d76a54e5). Ubuntu users should follow the distribution advisory at https://ubuntu.com/security/notices/USN-8593-1, and the upstream references are available at https://git.kernel.org/stable/c/d9defbf8b62bde89e206d74c2a2b445b9ed66108, https://git.kernel.org/stable/c/e96ef1a40dda5b637b1911cd950b11e9848de939, and https://git.kernel.org/stable/c/84371fb58423f997939aacdcbc02d128d76a54e5; the NVD entry is https://nvd.nist.gov/vuln/detail/CVE-2026-63998. Until patched, the effective compensating control is to remove the required privilege: do not grant CAP_NET_ADMIN to unprivileged users, containers, or service accounts (drop the capability from container profiles and systemd units, and use user namespaces/user namespace restrictions to prevent capability escalation into the host network namespace). The trade-off is that CAP_NET_ADMIN is also needed for legitimate network configuration, so scope it rather than removing it broadly. As a secondary measure on hardware whose drivers support module flashing, restrict or avoid the ETHTOOL_MSG_MODULE_FLASH netlink operation (for example by blocking the ethtool netlink request path from untrusted callers) - this eliminates the buggy branch entirely at the cost of losing in-band module firmware flashing. Repeatedly triggering the error path to exhaust kernel resources requires the same CAP_NET_ADMIN privilege, so capability minimization is the highest-value mitigation given the low EPSS (0.17%) and the absence of any observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The ethtool netlink interface (ethnl) exposes operations such as module EEPROM/flash access to userspace over generic netlink. Handlers of this class are wrapped in a begin/complete pair: ethnl_ops_begin() acquires the operational context (including a reference on the network device and, in the flash case, the driver's module-flash locking/rtnl context), performs the operation, and ethnl_ops_complete() releases it. The bug is a classic missing-cleanup-on-error-path defect: in the module flash handler, the error branch taken when validate() fails returns to the caller without invoking ethnl_ops_complete(), so the begin-side acquisition is never unwound. The affected code is upstream kernel networking (CPE cpe:2.3:a:linux:linux, all versions before the fixing commits). No CWE was assigned in the supplied data; the defect class is improper resource release/unbalanced lifecycle on an error path (consistent with CWE-404-style resource management issues) rather than memory corruption, so the observable effect is a resource/state leak that degrades availability rather than enabling code execution or data exposure. Note the input tag set labels this as 'Information Disclosure', which conflicts with the authoritative assessment vector (C:N/I:N/A:H) - the assessed impact is availability, and the tag should not be read as indicating confidentiality loss. EPSS 0.17% (percentile 6%) reflects the low likelihood of exploitation given the local, privileged, hardware-dependent trigger.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Flaw is reachable only via local privileged ethtool netlink operations (AV:L, PR:L), deterministically on the error path (AC:L), and causes only an availability-affecting lock/state imbalance (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: call ethnl_ops_complete() on module flash errors
When validate() fails we are skipping over ethnl_ops_complete() even tho we already called ethnl_ops_begin().
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB