CVE-2026-63987: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63987 Overview

CVE-2026-63987 is an out-of-bounds write vulnerability in the Linux kernel's ethtool subsystem. The flaw resides in ethnl_update_profile(), which processes ETHTOOL_A_PROFILE_IRQ_MODERATION nested Netlink attributes when updating interrupt coalescing profiles. The function walks the nest list using an index i and writes to new_profile[i++] without bounding i against NET_DIM_PARAMS_NUM_PROFILES, the fixed allocation size of 5 entries.

Because Netlink policies cannot constrain the number of nested or multi-attribute entries, the count is entirely user-controlled. A local attacker with permission to issue ethtool Netlink commands can overflow the destination buffer allocated via kmemdup().

Critical Impact
A local user can trigger a kernel heap out-of-bounds write, leading to memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel versions containing the ethtool coalesce profile update code path
Distributions shipping the affected kernel prior to the referenced stable commits
Systems where unprivileged or semi-privileged local users can issue ethtool Netlink operations

Discovery Timeline

2026-07-19 - CVE-2026-63987 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63987

Vulnerability Analysis

The ethtool Netlink interface exposes ETHTOOL_MSG_COALESCE_SET, which allows userspace to update Dynamic Interrupt Moderation (DIM) profiles for network devices. Inside ethnl_update_profile(), the kernel iterates over the ETHTOOL_A_PROFILE_IRQ_MODERATION nested attribute list and assigns each parsed entry into a destination array using the post-increment pattern new_profile[i++].

The destination buffer is duplicated from the current profile with kmemdup() at exactly NET_DIM_PARAMS_NUM_PROFILES (5) entries. The loop, however, does not check whether i exceeds this bound. A userspace caller can attach more than five nested profile entries to a single Netlink message, causing writes beyond the allocated slab region.

This is a classic [CWE-787] out-of-bounds write in kernel heap memory. Adjacent slab objects can be corrupted, which may result in a kernel panic or, with careful heap shaping, controlled overwrite of kernel data structures.

Root Cause

The root cause is missing input validation on a user-controlled nest count. Netlink attribute policies validate individual attribute types and sizes but do not cap the total number of entries in a nest or multi-attribute list. The kernel developer relied on an implicit assumption that callers would send at most NET_DIM_PARAMS_NUM_PROFILES entries.

Attack Vector

Exploitation requires local access and the ability to send ethtool Netlink messages, which typically requires CAP_NET_ADMIN in the relevant network namespace. In containerized environments where user namespaces grant CAP_NET_ADMIN inside the container, an unprivileged host user may reach this code path.

The attacker crafts an ETHTOOL_MSG_COALESCE_SET message with more than five ETHTOOL_A_PROFILE_IRQ_MODERATION nested entries. Each additional entry writes one dim_cq_moder structure past the end of the 5-element kmemdup() allocation, corrupting neighboring slab memory.

No verified public exploit code is available. Refer to the upstream fix commits for the exact bounding logic added to ethnl_update_profile().

Detection Methods for CVE-2026-63987

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN slab-out-of-bounds reports referencing ethnl_update_profile or net_dim symbols
Kernel log entries showing repeated ETHTOOL_MSG_COALESCE_SET operations from unprivileged processes or container workloads
Slab corruption warnings adjacent to kmalloc caches used for DIM profile allocations

Detection Strategies

Enable CONFIG_KASAN on test and canary hosts to catch out-of-bounds writes at the point of corruption
Audit process execution telemetry for local binaries invoking ethtool Netlink operations from unusual user contexts
Correlate kernel crash telemetry with recent Netlink socket activity from non-administrative processes

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on KASAN, BUG:, or general protection fault events referencing ethtool paths
Track containers with CAP_NET_ADMIN and monitor their ethtool and Netlink syscall usage
Baseline legitimate ethtool coalesce configuration changes and flag anomalies

How to Mitigate CVE-2026-63987

Immediate Actions Required

Apply the upstream stable kernel commits that cap profile updates at NET_DIM_PARAMS_NUM_PROFILES and rebuild or install patched vendor kernels
Inventory hosts and container images running kernels older than the fixed stable releases
Restrict CAP_NET_ADMIN in container runtimes and user namespaces where it is not strictly required

Patch Information

The fix bounds the loop index in ethnl_update_profile() so that no more than NET_DIM_PARAMS_NUM_PROFILES entries are written into new_profile. The patch is available in the following upstream stable commits:

Install the corresponding vendor-supplied kernel package and reboot affected systems.

Workarounds

Drop CAP_NET_ADMIN from containers and unprivileged services that do not require network interface configuration
Use seccomp or AppArmor profiles to block AF_NETLINK sockets of family NETLINK_GENERIC for workloads that do not need ethtool access
Restrict access to ethtool binaries and Netlink interfaces via mandatory access control policies until patches are deployed

bash

# Example: drop CAP_NET_ADMIN in a Docker container
docker run --cap-drop=NET_ADMIN --cap-drop=NET_RAW <image>

# Example: verify running kernel version after patching
uname -r