CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors
In the Linux kernel, the following vulnerability has been resolved:
ethtool: module: call ethnlopscomplete() on module flash errors
When validate() fails we are skipping over ethnlopscomplete() even tho we already called ethnlopsbegin().
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to systems running an affected Linux kernel where a local user has the required low-level privileges. The CVSS vector indicates the issue is not remotely exploitable.
What does an attacker need to exploit it?
An attacker needs local access and low privileges, with no user interaction required. Exploitation is associated with an error path during module flash validation after an operation has begun.
What is the expected security impact?
The reported impact is high availability impact only. No confidentiality or integrity impact is indicated by the CVSS vector.
What should teams do if they are affected?
Apply an available kernel patch. No alternative mitigation or configuration workaround is provided in the available data.