{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63985","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.025Z","datePublished":"2026-07-19T14:56:07.527Z","dateUpdated":"2026-08-05T12:37:53.524Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:37:53.524Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n  if (eeprom.offset + eeprom.len > total_len)\n      return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending an ETHTOOL_MSG_MODULE_EEPROM_GET Netlink request to the kernel; this is a local syscall/interface path, not remote packet processing.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft page/offset/length values after querying module info, and only needs a netdev using the legacy fallback path (common on ice/ixgbe/i40e-class drivers without get_module_eeprom_by_page).\nPR:L - The ethtool Netlink handler is registered with GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the caller's user namespace, which is obtainable via unprivileged user namespaces (e.g., unshare -Urn).\nUI:N - No victim interaction is required; the attacker triggers the malformed EEPROM read directly via Netlink.\nS:U - Impact remains within the kernel/driver/NIC security domain on the same host; this is not a VM escape or cross-authority boundary crossing.\nC:H - The fallback path used kmalloc() instead of kzalloc(), allowing uninitialized kernel heap contents to be returned to userspace, and out-of-bounds offset+length values cause legacy drivers to read and return data from beyond the declared EEPROM region (NIC/module memory).\nI:H - The fix commit explicitly warns of \"surprises in both drivers and device FW\" from out-of-bounds EEPROM access; on datacenter/cloud NICs this can drive NIC or transceiver firmware into undefined states that alter device behavior beyond the intended read-only query.\nA:H - Invalid EEPROM parameters passed to driver and device firmware can cause kernel driver errors, NIC firmware hangs/resets, or link loss on production servers with optical modules installed."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ethtool/eeprom.c"],"versions":[{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"0e182689831277faf2ef683573a60474c208f690","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"65674d2489a12b8efd2ca0effb3de1d12224b596","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"d81376053a00865c70b8d8506a1cb93f2943d413","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"fd0de51c54fa8474a0ddeedd71c65ad09fada390","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"4fe1bc4b3603f621240d5b401742f302190db769","status":"affected","versionType":"git"},{"version":"96d971e307cc0e434f96329b42bbd98cfbca07d2","lessThan":"67cfdd9210b99f260b3e0afeb9525e0acc7be31e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ethtool/eeprom.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"},{"url":"https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"},{"url":"https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"},{"url":"https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"},{"url":"https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"},{"url":"https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"},{"url":"https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"}],"title":"ethtool: eeprom: add more safeties to EEPROM Netlink fallback","x_generator":{"engine":"bippy-1.2.0"}}}}