CVE-2026-63985: Linux Kernel EEPROM Validation Vulnerability

CVE-2026-63985 Overview

CVE-2026-63985 is a Linux kernel vulnerability in the ethtool subsystem. The Netlink fallback path for reading module EEPROM data fails to validate the combined offset + length value against eeprom_len. Only the offset < eeprom_len check is enforced in fallback_set_params(), while the ioctl equivalent ethtool_get_any_eeprom() validates both bounds. The flaw can trigger out-of-bounds reads and pass unexpected parameters to network device drivers and device firmware. A related issue involves eeprom_fallback() using kmalloc() instead of kzalloc(), leaving buffers uninitialized before being handed to drivers.

Critical Impact
A local user with permission to invoke ethtool Netlink EEPROM operations can trigger out-of-bounds reads and expose uninitialized kernel memory to userspace or device firmware.

Affected Products

Linux kernel (mainline) — ethtool Netlink EEPROM fallback path
Stable kernel branches referenced in the upstream fix commits
Distributions shipping affected stable kernels prior to backport

Discovery Timeline

2026-07-19 - CVE-2026-63985 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63985

Vulnerability Analysis

The vulnerability resides in the ethtool Netlink fallback path used when a driver does not implement native Netlink EEPROM operations. The function fallback_set_params() validates that the caller-supplied offset is less than the device's eeprom_len, but it does not verify that offset + length also stays within eeprom_len. This omission allows a read request to extend past the declared EEPROM region.

The legacy ioctl path in ioctl.c, specifically ethtool_get_any_eeprom(), has always enforced both bounds using if (eeprom.offset + eeprom.len > total_len) return -EINVAL;. The Netlink path diverged from this behavior, producing inconsistent input validation between two interfaces reaching the same driver operations.

A secondary issue affects eeprom_fallback(), which allocates its working buffer with kmalloc(). Because ethtool core zero-initializes buffers passed to drivers, using an uninitialized allocation can allow residual kernel heap contents to leak to userspace when a driver returns short reads or ignores the buffer.

Root Cause

The root cause is missing boundary validation combined with an uninitialized memory allocation [CWE-125, CWE-908]. The Netlink handler trusts driver behavior to bound the actual read, but drivers and device firmware can behave unpredictably when handed lengths that exceed their advertised EEPROM size.

Attack Vector

A local attacker with the capability to issue ethtool Netlink commands on a network interface can craft a request with a valid offset and an oversized length. The kernel accepts the request, passes the arguments to the driver, and may return uninitialized buffer contents. The impact depends on the specific NIC driver and firmware, ranging from information disclosure to driver-side memory corruption.

The vulnerability requires local access and low privileges. No user interaction is required. The upstream fix mirrors the ioctl-side bounds check and replaces kmalloc() with kzalloc() in eeprom_fallback().

Detection Methods for CVE-2026-63985

Indicators of Compromise

Unexpected ethtool Netlink EEPROM read requests where offset + length exceeds the reported module EEPROM size
Kernel log entries or driver warnings referencing EEPROM read errors from ethtool_get_module_eeprom code paths
Anomalous userspace processes invoking ETHTOOL_MSG_MODULE_EEPROM_GET with large length values on multiple interfaces

Detection Strategies

Audit kernel version and confirm whether patch commits 0e18268983, 4fe1bc4b36, 65674d2489, 67cfdd9210, 6ed7ebe22e, d8137605, or fd0de51c54 are present in the running kernel
Enable auditd rules on netlink sockets of family NETLINK_GENERIC to capture ethtool operations issued by non-administrative users
Monitor for programs beyond standard network management tooling (ethtool, NetworkManager, systemd-networkd) issuing module EEPROM queries

Monitoring Recommendations

Ingest kernel and audit logs into a centralized platform and alert on repeated EEPROM read failures returning -EINVAL or -EFAULT
Track new or unsigned binaries invoking ethtool Netlink APIs against production interfaces
Baseline expected ethtool activity per host role and alert on deviations, particularly on servers with SFP/QSFP modules

How to Mitigate CVE-2026-63985

Immediate Actions Required

Update to a stable Linux kernel release containing the upstream fix commits listed in the Linux kernel git history
Prioritize patching multi-tenant hosts, container hosts, and systems where untrusted local users can execute ethtool commands
Verify vendor-supplied kernel packages (RHEL, Ubuntu, SUSE, Debian) include backports of the referenced commits before deploying

Patch Information

The fix adds the missing offset + length bounds check to fallback_set_params(), mirroring the ioctl path ethtool_get_any_eeprom(). It also replaces the kmalloc() call in eeprom_fallback() with kzalloc() to zero-initialize the buffer before it is passed to drivers. Backport commits are available at commit 0e1826898312, commit 4fe1bc4b3603, commit 65674d2489a1, commit 67cfdd9210b9, commit 6ed7ebe22e9c, commit d81376053a00, and commit fd0de51c54fa.

Workarounds

Restrict ethtool Netlink access to privileged administrators by removing CAP_NET_ADMIN from unprivileged user namespaces on affected hosts
Apply kernel lockdown or seccomp filters to block ethtool Netlink EEPROM operations from untrusted workloads until patching is complete
On container hosts, avoid granting NET_ADMIN capability to containers that do not require it

bash

# Verify running kernel version and check for the fix
uname -r

# Example: restrict CAP_NET_ADMIN via systemd for a service
# /etc/systemd/system/example.service.d/override.conf
[Service]
CapabilityBoundingSet=~CAP_NET_ADMIN
AmbientCapabilities=