CVE-2026-63985

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63985", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.025Z", "datePublished": "2026-07-19T14:56:07.527Z", "dateUpdated": "2026-10-19T20:18:00.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:53.524Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n if (eeprom.offset + eeprom.len > total_len)\n return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending an ETHTOOL_MSG_MODULE_EEPROM_GET Netlink request to the kernel; this is a local syscall/interface path, not remote packet processing.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft page/offset/length values after querying module info, and only needs a netdev using the legacy fallback path (common on ice/ixgbe/i40e-class drivers without get_module_eeprom_by_page).\nPR:L - The ethtool Netlink handler is registered with GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the caller's user namespace, which is obtainable via unprivileged user namespaces (e.g., unshare -Urn).\nUI:N - No victim interaction is required; the attacker triggers the malformed EEPROM read directly via Netlink.\nS:U - Impact remains within the kernel/driver/NIC security domain on the same host; this is not a VM escape or cross-authority boundary crossing.\nC:H - The fallback path used kmalloc() instead of kzalloc(), allowing uninitialized kernel heap contents to be returned to userspace, and out-of-bounds offset+length values cause legacy drivers to read and return data from beyond the declared EEPROM region (NIC/module memory).\nI:H - The fix commit explicitly warns of \"surprises in both drivers and device FW\" from out-of-bounds EEPROM access; on datacenter/cloud NICs this can drive NIC or transceiver firmware into undefined states that alter device behavior beyond the intended read-only query.\nA:H - Invalid EEPROM parameters passed to driver and device firmware can cause kernel driver errors, NIC firmware hangs/resets, or link loss on production servers with optical modules installed."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/eeprom.c"], "versions": [{"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "0e182689831277faf2ef683573a60474c208f690", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "4fe1bc4b3603f621240d5b401742f302190db769", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/eeprom.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"}, {"url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"}, {"url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"}, {"url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"}, {"url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"}, {"url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"}, {"url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"}], "title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:41.503589Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:18:00.907Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:41.503589Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:34:42.183Z"}}], "cna": {"title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires sending an ETHTOOL_MSG_MODULE_EEPROM_GET Netlink request to the kernel; this is a local syscall/interface path, not remote packet processing.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically craft page/offset/length values after querying module info, and only needs a netdev using the legacy fallback path (common on ice/ixgbe/i40e-class drivers without get_module_eeprom_by_page).\nPR:L - The ethtool Netlink handler is registered with GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the caller's user namespace, which is obtainable via unprivileged user namespaces (e.g., unshare -Urn).\nUI:N - No victim interaction is required; the attacker triggers the malformed EEPROM read directly via Netlink.\nS:U - Impact remains within the kernel/driver/NIC security domain on the same host; this is not a VM escape or cross-authority boundary crossing.\nC:H - The fallback path used kmalloc() instead of kzalloc(), allowing uninitialized kernel heap contents to be returned to userspace, and out-of-bounds offset+length values cause legacy drivers to read and return data from beyond the declared EEPROM region (NIC/module memory).\nI:H - The fix commit explicitly warns of \"surprises in both drivers and device FW\" from out-of-bounds EEPROM access; on datacenter/cloud NICs this can drive NIC or transceiver firmware into undefined states that alter device behavior beyond the intended read-only query.\nA:H - Invalid EEPROM parameters passed to driver and device firmware can cause kernel driver errors, NIC firmware hangs/resets, or link loss on production servers with optical modules installed."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "0e182689831277faf2ef683573a60474c208f690", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "4fe1bc4b3603f621240d5b401742f302190db769", "versionType": "git"}, {"status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e", "versionType": "git"}], "programFiles": ["net/ethtool/eeprom.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ethtool/eeprom.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"}, {"url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"}, {"url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"}, {"url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"}, {"url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"}, {"url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"}, {"url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n if (eeprom.offset + eeprom.len > total_len)\n return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:53.524Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63985", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:18:00.907Z", "dateReserved": "2026-07-19T07:54:57.025Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:07.527Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ethtool/eeprom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0e182689831277faf2ef683573a60474c208f690", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "4fe1bc4b3603f621240d5b401742f302190db769", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}, {"lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e", "status": "affected", "version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ethtool/eeprom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C07B6F51-E606-4A39-BC33-B4C6C28629D0", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n if (eeprom.offset + eeprom.len > total_len)\n return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."}], "id": "CVE-2026-63985", "lastModified": "2026-10-19T21:17:16.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63985", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:34:41.503589Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:17.723", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "id": "2502340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502340"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\nif (eeprom.offset + eeprom.len > total_len)\nreturn -EINVAL;\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc.", "A flaw was found in the Linux kernel's ethtool component, specifically within the EEPROM Netlink fallback path. The fallback_set_params() function fails to properly validate the length of data being read from the module's EEPROM, allowing for an out-of-bounds read. Additionally, the eeprom_fallback() function uses an uninitialized memory buffer, which could lead to the disclosure of sensitive kernel memory information. This vulnerability could result in unexpected behavior in device drivers and firmware, and potentially expose internal kernel data."], "name": "CVE-2026-63985", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63985\nhttps://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63985-56d0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,0e182689831277faf2ef683573a60474c208f690)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,65674d2489a12b8efd2ca0effb3de1d12224b596)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,d81376053a00865c70b8d8506a1cb93f2943d413)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,fd0de51c54fa8474a0ddeedd71c65ad09fada390)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,4fe1bc4b3603f621240d5b401742f302190db769)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,67cfdd9210b99f260b3e0afeb9525e0acc7be31e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T06:30:02.541963+00:00", "updated": "2026-10-08T19:45:07.634547+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}