CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: avoid leaking a netdev ref on module flash errors
moduleflashfwschedule() is missing undo for setting the "inprogress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnllock.
Affected Software
Remediation
Event History
Frequently Asked Questions
Can this be exploited remotely?
No. The CVSS vector identifies this as a local attack (AV:L), requiring an attacker to already have low-level privileges on the affected system; no user interaction is required.
What is the practical impact of a successful exploit?
The reported impact is availability only (A:H). Module flash error handling can leak a network-device reference and leave the operation marked in progress, potentially causing a high availability impact; confidentiality and integrity are not affected according to the CVSS vector.
What should teams do if they cannot patch immediately?
Restrict local access to trusted users and limit use of network-module firmware flashing operations where operationally feasible. A patch is available, but the provided information does not identify affected or fixed kernel versions.