SB20260720252 - Improper input validation in Linux kernel ethtool

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260720252

SB20260720252 - Improper input validation in Linux kernel ethtool

Published: July 20, 2026

Security Bulletin ID SB20260720252
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2026-63985)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in fallback_set_params() in the ethtool EEPROM Netlink fallback path when processing module EEPROM read parameters. A local user can supply an offset and length combination that exceeds the EEPROM bounds to cause a denial of service.

The issue affects the Netlink fallback path for reading module EEPROM and may lead to unexpected behavior in drivers or device firmware.


Remediation

Install update from vendor's website.

References