CVE-2026-63985 (GCVE-0-2026-63985)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:37
VLAI
Title
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
Summary
In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM (fallback_set_params()) validates that offset < eeprom_len, but does not check that offset + length stays within eeprom_len. The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has always enforced both bounds: if (eeprom.offset + eeprom.len > total_len) return -EINVAL; This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallback_set_params(), mirroring the ioctl. Similarly - ethtool core in general, and ethtool_get_any_eeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eeprom_fallback() uses a plain kmalloc(), change it to zalloc.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < 0e182689831277faf2ef683573a60474c208f690 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < 6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < 65674d2489a12b8efd2ca0effb3de1d12224b596 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < d81376053a00865c70b8d8506a1cb93f2943d413 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < fd0de51c54fa8474a0ddeedd71c65ad09fada390 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < 4fe1bc4b3603f621240d5b401742f302190db769 (git)
Affected: 96d971e307cc0e434f96329b42bbd98cfbca07d2 , < 67cfdd9210b99f260b3e0afeb9525e0acc7be31e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e182689831277faf2ef683573a60474c208f690",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "4fe1bc4b3603f621240d5b401742f302190db769",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            },
            {
              "lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e",
              "status": "affected",
              "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset \u003c eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n  if (eeprom.offset + eeprom.len \u003e total_len)\n      return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires sending an ETHTOOL_MSG_MODULE_EEPROM_GET Netlink request to the kernel; this is a local syscall/interface path, not remote packet processing.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft page/offset/length values after querying module info, and only needs a netdev using the legacy fallback path (common on ice/ixgbe/i40e-class drivers without get_module_eeprom_by_page).\nPR:L - The ethtool Netlink handler is registered with GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the caller\u0027s user namespace, which is obtainable via unprivileged user namespaces (e.g., unshare -Urn).\nUI:N - No victim interaction is required; the attacker triggers the malformed EEPROM read directly via Netlink.\nS:U - Impact remains within the kernel/driver/NIC security domain on the same host; this is not a VM escape or cross-authority boundary crossing.\nC:H - The fallback path used kmalloc() instead of kzalloc(), allowing uninitialized kernel heap contents to be returned to userspace, and out-of-bounds offset+length values cause legacy drivers to read and return data from beyond the declared EEPROM region (NIC/module memory).\nI:H - The fix commit explicitly warns of \"surprises in both drivers and device FW\" from out-of-bounds EEPROM access; on datacenter/cloud NICs this can drive NIC or transceiver firmware into undefined states that alter device behavior beyond the intended read-only query.\nA:H - Invalid EEPROM parameters passed to driver and device firmware can cause kernel driver errors, NIC firmware hangs/resets, or link loss on production servers with optical modules installed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:53.524Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"
        },
        {
          "url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"
        },
        {
          "url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"
        },
        {
          "url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"
        }
      ],
      "title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63985",
    "datePublished": "2026-07-19T14:56:07.527Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-08-05T12:37:53.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63985",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02941"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ethtool/eeprom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0e182689831277faf2ef683573a60474c208f690",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fe1bc4b3603f621240d5b401742f302190db769",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e",
                    "status": "affected",
                    "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ethtool/eeprom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset \u003c eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n  if (eeprom.offset + eeprom.len \u003e total_len)\n      return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."
          }
        ],
        "id": "CVE-2026-63985",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:17.723",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:06:05+00:00",
      "cve": "CVE-2026-63985",
      "id": "CVE-2026-63985",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ethtool: eeprom: add more safeties to EEPROM Netlink fallback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63985.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:45:22Z",
      "cve": "CVE-2026-63985",
      "id": "CVE-2026-63985",
      "initial_release_date": "2026-07-21T13:02:09Z",
      "product_status:known_affected": "586",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63985",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63985.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.