CVE-2026-68440 (GCVE-0-2026-68440)

Vulnerability from cvelistv5 – Published: 2026-08-12 00:07 – Updated: 2026-08-17 05:05
VLAI
Title
net: txgbe: fix heap overflow when reading module EEPROM
Summary
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-aligned length therefore causes an out-of-bounds write. Copy only the remaining bytes on the final dword instead.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b97b6b5635b3de18debd07a3adcf25198ec8299 , < febcced6958158e7e90a55a8567b3f5c3639c0b9 (git)
Affected: 9b97b6b5635b3de18debd07a3adcf25198ec8299 , < 6a905a71fd43ce8b45f05044b11491337f232c9d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "febcced6958158e7e90a55a8567b3f5c3639c0b9",
              "status": "affected",
              "version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
              "versionType": "git"
            },
            {
              "lessThan": "6a905a71fd43ce8b45f05044b11491337f232c9d",
              "status": "affected",
              "version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix heap overflow when reading module EEPROM\n\ntxgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes\ninto the caller buffer, which ethtool allocates with exactly \u0027length\u0027\nbytes. A non-4-aligned length therefore causes an out-of-bounds write.\nCopy only the remaining bytes on the final dword instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through the ethtool genetlink interface (ETHTOOL_MSG_MODULE_EEPROM_GET) from a local socket; no network packet or remote peer data reaches the vulnerable copy loop.\nAC:L - The attacker fully controls the request length attribute (policy allows 1..128 with no alignment constraint), so any non-4-aligned value deterministically triggers the over-copy on every call, repeatably and without racing.\nPR:L - The ethtool op is gated by GENL_UNS_ADMIN_PERM, i.e. ns-capable CAP_NET_ADMIN in the user namespace owning the netdev\u0027s netns, which an unprivileged user can obtain via unshare -Urn rather than real root.\nUI:N - The attacker issues the ethtool netlink request directly; no victim action, module plug event, or administrator step is needed.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow is a heap memory-corruption primitive adjacent to attacker-groomable slab objects, and corrupting neighbouring object metadata (lengths, pointers) can be leveraged to disclose arbitrary kernel memory back through the same ethtool reply.\nI:H - This is an out-of-bounds heap write with firmware/module-supplied bytes past the end of a caller-sized kmalloc buffer, giving an attacker-triggerable corruption of adjacent kernel data that can be steered toward control-flow hijacking.\nA:H - Corrupting adjacent slab objects or allocator metadata leads to kernel oops/panic, and on KASAN or hardened configurations the slab-out-of-bounds write itself aborts the kernel, so a repeatable denial of service is available."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:05:37.444Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/febcced6958158e7e90a55a8567b3f5c3639c0b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a905a71fd43ce8b45f05044b11491337f232c9d"
        }
      ],
      "title": "net: txgbe: fix heap overflow when reading module EEPROM",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68440",
    "datePublished": "2026-08-12T00:07:29.605Z",
    "dateReserved": "2026-07-30T09:28:09.394Z",
    "dateUpdated": "2026-08-17T05:05:37.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68440",
      "date": "2026-09-21",
      "epss": "0.00124",
      "percentile": "0.02448"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "febcced6958158e7e90a55a8567b3f5c3639c0b9",
                    "status": "affected",
                    "version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a905a71fd43ce8b45f05044b11491337f232c9d",
                    "status": "affected",
                    "version": "9b97b6b5635b3de18debd07a3adcf25198ec8299",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.19"
                  },
                  {
                    "lessThan": "6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix heap overflow when reading module EEPROM\n\ntxgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes\ninto the caller buffer, which ethtool allocates with exactly \u0027length\u0027\nbytes. A non-4-aligned length therefore causes an out-of-bounds write.\nCopy only the remaining bytes on the final dword instead."
          }
        ],
        "id": "CVE-2026-68440",
        "lastModified": "2026-08-17T06:17:53.067",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-12T00:17:44.247",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a905a71fd43ce8b45f05044b11491337f232c9d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/febcced6958158e7e90a55a8567b3f5c3639c0b9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:13:05+00:00",
      "cve": "CVE-2026-68440",
      "id": "CVE-2026-68440",
      "initial_release_date": "2026-08-12T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: txgbe: fix heap overflow when reading module EEPROM",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68440.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-13T01:27:46Z",
      "cve": "CVE-2026-68440",
      "id": "CVE-2026-68440",
      "initial_release_date": "2026-08-12T16:21:57Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68440",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68440.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.