EUVD-2026-45572
GHSA-9pm4-3wgp-cph8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access with ethtool privileges
-
DeliveryInvoke ethtool RSS get_rxfh repeatedly
-
ExploitForce get_rxfh() error path
-
ExecutionLeak indir_table and hkey each call
-
ImpactExhaust kernel memory causing DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires local access with privileges to perform ethtool RSS configuration queries (typically CAP_NET_ADMIN) and the ability to drive ops->get_rxfh() into its failure path - e.g. a NIC/driver or device state that causes the RSS 'get' operation to return an error. Impact is limited by: local-only attack vector (no remote reach), the need for privileged ethtool access, and the requirement to repeat the failing call many times to leak enough kernel memory to matter (a single leak is small). No confidentiality or integrity impact occurs; the only outcome is gradual kernel memory exhaustion leading to denial of service. |
| Impact | This is a low-to-moderate priority issue despite being a CRITICAL-sounding 'kernel vulnerability'. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, low-privilege, availability-only impact - consistent with the CWE-401 memory-leak root cause: the error path in rss_prepare_get() fails to free the indirection table and hash key when ops->get_rxfh() returns an error. The EPSS score of 0.17% (6th percentile) corroborates very low real-world exploitation probability, and there is no CISA KEV listing and no public POC referenced, so all exploitation signals align toward low urgency. There is one notable conflict: the input Tags label this 'Information Disclosure', yet the CVSS explicitly sets C:N/I:N with only A:H, and CWE-401 is a resource/memory leak, not a disclosure flaw - the impact is kernel memory exhaustion (DoS), not data leakage. No SSVC decision data was provided. Net: this is a genuine but low-severity resource-exhaustion fix affecting an enormously deployed product; patch it through normal stable-kernel update cadence rather than as an emergency. |
| Exploit ScenarioDerived | A local user with the ability to invoke ethtool RSS 'get' operations repeatedly triggers the get_rxfh() error path (for example on a device/driver that returns an error for the RSS query), causing the kernel to leak the indirection table and hash key buffer on every failed call. Sustained repetition slowly exhausts kernel memory, degrading or crashing the system. No public exploit code is referenced, and the impact is availability only, not code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Repeated ethtool RSS 'get' operations on affected Linux kernels leak the indirection table and hash key buffers allocated for each call, allowing a local user with privileges sufficient to issue those ethtool requests (CVSS PR:L, typically CAP_NET_ADMIN) to steadily exhaust kernel heap memory and eventually cause a denial of service. The flaw is a missing-free on the error path of rss_prepare_get(): when the driver's get_rxfh() callback returns an error after rss_get_data_alloc() has already succeeded, the allocations are never released. Rated CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with EPSS 0.17% (6th percentile), this is a local-only, low-urgency issue: there is no confidentiality or integrity impact, no remote attack surface, no confirmed active exploitation (not in CISA KEV), and no public exploit code identified at time of analysis - the practical barrier is that many repetitions are needed to leak meaningful memory.
RemediationAI
Vendor-released patches are available: upstream fixes are incorporated in Linux 6.18.35, 7.0.12, and 7.1, and the individual stable commits are published at https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea, https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f, and https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3; patch data from the vendor confirms availability. Update the kernel to a release at or above the fixed version for your branch (for example 5.15.181+/5.16+, 6.1.135+/6.2+, 6.6.88+/6.7+, 6.12.24+/6.13+, 6.13.12+/6.14+, 6.14.3+/6.15+ per the EUVD ranges, or the unified 6.18.35 / 7.0.12 / 7.1 fixes) and reboot, since a kernel memory-leak fix cannot be applied live without kpatch-style tooling. Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1), and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-63999) tracks the record. If patching must be deferred, the practical compensating control is to restrict the ability to issue ethtool RSS queries: the attack requires local low-privileged access with CAP_NET_ADMIN, so removing that capability from untrusted local users, container workloads, and unprivileged user namespaces (which can otherwise grant network-admin capability inside a new namespace) removes the trigger path entirely, at the cost of breaking legitimate network configuration tooling for those accounts. Frequent repeated failures can also be surfaced by monitoring dmesg/advisory logs and per-process memory growth, but this is detection, not prevention, and is unreliable against slow leaks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the Linux kernel's ethtool receive-side scaling (RSS) support, specifically in the RSS netlink handler that services user-space requests for the current RSS configuration. rss_prepare_get() allocates two variable-length buffers via rss_get_data_alloc(): the RSS indirection table (indir_table) and the hash key (hkey). It then calls the NIC driver's ethtool_ops->get_rxfh() callback to populate them. The error path is defective - if get_rxfh() fails (for example because the driver or device state cannot satisfy the request), the function returns an error code without freeing either allocation, classifying it as CWE-401, Missing Release of Memory After Effective Lifetime. The relevant CPE entries (cpe:2.3:a:linux:linux) reflect that this is mainline and stable-branch kernel code rather than a user-space package, and the tagged impact 'Information Disclosure' is best read as incidental memory not being returned to the allocator rather than a data-exposure primitive. Because the buffers are caller-supplied heap objects sized by the RSS configuration, each leaked iteration is modest, so exploitation is a slow accumulation problem rather than an immediate out-of-memory event.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local ethtool RSS query needs CAP_NET_ADMIN (PR:L, AV:L); repeated failed calls leak kernel memory causing DoS, so A:H with C:N/I:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB