CVE-2026-63986 Overview
CVE-2026-63986 affects the Linux kernel's ethtool netlink subsystem. The vulnerability exists in the tsinfo (timestamping information) dump path, where an error path passes an ERR_PTR value to genlmsg_cancel(). When ethnl_tsinfo_prepare_dump() fails, the code jumps to the err label and calls genlmsg_cancel(skb, ehdr) on a header that was never allocated. Dereferencing the error pointer inside genlmsg_cancel() triggers a kernel crash.
Critical Impact
A local user querying ethtool timestamping information can trigger a kernel crash when the prepare step fails, resulting in a denial of service on the affected host.
Affected Products
- Linux kernel versions containing the ethtool netlink tsinfo dump handler with the faulty err path
- Distributions shipping the affected upstream kernel prior to the fix commits
- Systems exposing ethtool netlink operations to unprivileged or local users
Discovery Timeline
- 2026-07-19 - CVE-2026-63986 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63986
Vulnerability Analysis
The defect lives in the ethtool netlink handler responsible for dumping tsinfo data via generic netlink. The dump routine first calls ethnl_tsinfo_prepare_dump(), which is expected to initialize a generic netlink message header referenced by ehdr. On success, the caller populates attributes and finalizes the message. On failure, the routine jumps to an err label that unconditionally invokes genlmsg_cancel(skb, ehdr) before returning the error code.
When ethnl_tsinfo_prepare_dump() fails, no genlmsg has been started and ehdr holds an ERR_PTR encoded pointer rather than a valid message header. genlmsg_cancel() internally calls genlmsg_end() semantics that trim the skb using the header pointer as a reference. Passing an ERR_PTR causes the kernel to compute an invalid offset into the socket buffer and dereference an unmapped address, producing a general protection fault or oops. The fix removes the erroneous cancel call on the failure path so no cleanup is attempted for a message that was never started.
Root Cause
The root cause is improper error handling in the ethtool tsinfo dump routine. The single err label conflates two distinct failure states: failures that occur after a genlmsg has been started and failures that occur before. Only the former requires a genlmsg_cancel() call. This is an error pointer misuse pattern classified under improper check for unusual or exceptional conditions.
Attack Vector
Any local process able to issue ethtool netlink requests can attempt to dump tsinfo. If ethnl_tsinfo_prepare_dump() can be induced to fail, the resulting call to genlmsg_cancel() on an ERR_PTR crashes the kernel. The impact is a local denial of service against the host. No remote or authenticated network path is required beyond the ability to talk to AF_NETLINK and the NETLINK_GENERIC family.
No verified public proof-of-concept code is available. Technical details are documented in the upstream fixes: Linux Kernel Commit 2008f9bb, Linux Kernel Commit c3fc9976, and Linux Kernel Commit d0d2c5cc.
Detection Methods for CVE-2026-63986
Indicators of Compromise
- Kernel oops or general protection fault messages referencing genlmsg_cancel, ethnl_tsinfo, or ethtool_tsinfo_dumpit in dmesg or /var/log/kern.log
- Unexpected host reboots or panics correlated with ethtool netlink activity from local processes
- Repeated invocations of ethtool timestamping queries from non-administrative users
Detection Strategies
- Monitor kernel ring buffer output for stack traces containing genlmsg_cancel alongside ethtool tsinfo call frames
- Audit local process activity that opens AF_NETLINK sockets bound to the generic netlink family and issues ETHTOOL_MSG_TSINFO_GET requests
- Correlate kernel crash telemetry with running kernel version to identify hosts that have not received the fix commits
Monitoring Recommendations
- Ingest kernel.crash and kernel.oops events into your SIEM and alert on stack frames referencing ethnl_tsinfo_prepare_dump
- Track kernel package versions across the fleet and flag hosts running builds prior to the upstream fix
- Baseline ethtool netlink usage on production hosts so anomalous timestamping queries stand out
How to Mitigate CVE-2026-63986
Immediate Actions Required
- Update affected Linux kernels to a version containing the upstream fix commits referenced by the CVE
- Reboot systems into the patched kernel to activate the fix, since the change is not applicable as a live patch on all distributions
- Inventory hosts running kernels that expose the ethtool netlink interface and prioritize multi-tenant or shared systems
Patch Information
The issue is resolved by three upstream commits that remove the incorrect genlmsg_cancel() call from the failure path in ethnl_tsinfo_dumpit: Linux Kernel Commit 2008f9bb, Linux Kernel Commit c3fc9976, and Linux Kernel Commit d0d2c5cc. Apply vendor kernel updates from your distribution as they become available.
Workarounds
- Restrict local access to untrusted users on shared hosts until patched kernels are deployed
- Where feasible, limit access to generic netlink from unprivileged containers using seccomp or user namespace policies
- Monitor dmesg for early signs of exploitation attempts and isolate affected hosts pending patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
