CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback
In the Linux kernel, the following vulnerability has been resolved:
ethtool: eeprom: add more safeties to EEPROM Netlink fallback
The Netlink fallback path for reading module EEPROM (fallbacksetparams()) validates that offset < eepromlen, but does not check that offset + length stays within eepromlen. The ioctl equivalent (ethtoolgetanyeeprom() in ioctl.c) has always enforced both bounds:
if (eeprom.offset + eeprom.len > totallen) return -EINVAL;
This could lead to surprises in both drivers and device FW. Add the missing offset + length validation to fallbacksetparams(), mirroring the ioctl.
Similarly - ethtool core in general, and ethtoolgetanyeeprom() in particular tries to zero-init all buffers passed to the drivers to avoid any extra work of zeroing things out. eepromfallback() uses a plain kmalloc(), change it to zalloc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In fallback_set_params(), validate that offset + length stays within eeprom_len; reject the request with -EINVAL when eeprom.offset + eeprom.len > total_len.
- Compensating control
In the Netlink EEPROM fallback path, use zero-initializing allocation (zalloc) instead of plain kmalloc() for buffers passed to drivers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63985?
CVE-2026-63985 has been assigned a risk score of 15, indicating a critical severity level.
How do I fix CVE-2026-63985?
To fix CVE-2026-63985, update the Linux kernel to the latest patched version that resolves this vulnerability.
What systems are affected by CVE-2026-63985?
CVE-2026-63985 affects the Linux kernel, specifically in the ethtool functionality related to EEPROM handling.
What kind of attacks can exploit CVE-2026-63985?
Exploitation of CVE-2026-63985 could allow unauthorized access to sensitive EEPROM data or result in denial of service.
When was CVE-2026-63985 published?
CVE-2026-63985 was published on July 19, 2026.