CVE-2026-63997 Overview
CVE-2026-63997 affects the Linux kernel's ethtool module flash firmware subsystem. The vulnerability stems from missing cleanup logic in module_flash_fw_schedule(), which fails to undo the in_progress flag and release the acquired netdev reference when errors occur during module firmware flash scheduling. This results in a netdev reference leak, a class of resource management defect that can degrade kernel stability over time. The upstream fix delays taking the reference and setting the flag until success is guaranteed, relying on the rtnl_lock to ensure the device cannot disappear during the operation.
Critical Impact
A reference count leak on the network device structure prevents proper cleanup of network interfaces after failed firmware flash operations, potentially leading to resource exhaustion and interface state inconsistencies.
Affected Products
- Linux kernel (upstream) containing the ethtool module firmware flash subsystem
- Stable kernel branches receiving backported fixes via commits 61848c83, 956b134d, f7b4513e, and fb7f511d
- Linux distributions shipping affected kernel versions
Discovery Timeline
- 2026-07-19 - CVE-2026-63997 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63997
Vulnerability Analysis
The defect resides in the kernel's ethtool module flash implementation. The function module_flash_fw_schedule() is responsible for scheduling asynchronous firmware flash operations against a network device module such as an SFP or QSFP transceiver. During setup, the function marks the operation as in_progress and acquires a reference on the netdev via dev_hold() or equivalent. If a subsequent step in the scheduling path fails, the original code returns an error without reversing these two side effects. The result is a leaked netdev reference and a stuck in_progress state that persists across the failure boundary.
A leaked netdev reference prevents the kernel from tearing down the network device object when it is later unregistered. This can block interface removal, keep the device visible to userspace after teardown, and consume kernel memory that is never reclaimed. Repeated failed flash attempts can compound the leak.
Root Cause
The root cause is an ordering bug: state mutation and reference acquisition occur before the last fallible step in module_flash_fw_schedule(), without matching cleanup on the error path. The remediation reorders the logic so the in_progress flag and netdev reference are only taken once the schedule operation is guaranteed to succeed. Because the code path already holds rtnl_lock, the network device cannot be removed concurrently, so delaying the reference acquisition is safe.
Attack Vector
Triggering the leak requires local privileges sufficient to invoke ethtool module flash operations, typically CAP_NET_ADMIN. An operator or process with these privileges can repeatedly initiate module firmware flash requests that fail during scheduling, gradually leaking references and state. The vulnerability is not remotely exploitable and does not directly yield code execution.
Refer to the upstream commits 61848c83, 956b134d, f7b4513e, and fb7f511d on git.kernel.org for the exact patch diff and affected code paths.
Detection Methods for CVE-2026-63997
Indicators of Compromise
- Kernel log messages referencing failed ethtool module flash operations followed by inability to remove or reset the associated netdev
- Network interfaces that remain visible in /sys/class/net/ after being administratively removed
- Elevated refcnt values on netdev objects observable via kernel debugging interfaces after failed firmware flash attempts
Detection Strategies
- Audit kernel versions across the fleet against the patched commits 61848c83, 956b134d, f7b4513e, and fb7f511d to identify unpatched hosts
- Monitor for repeated ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink operations that terminate in error, which correlate with the leak path
- Track long-lived in_progress flash states on interfaces that never emit a completion notification
Monitoring Recommendations
- Collect dmesg and journald kernel logs centrally and alert on ethtool module flash errors
- Track netdev reference counts on systems that regularly perform transceiver firmware updates
- Correlate ethtool netlink activity with privileged process execution to identify unusual flash attempt patterns
How to Mitigate CVE-2026-63997
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 61848c83, 956b134d, f7b4513e, and fb7f511d
- Restrict CAP_NET_ADMIN to trusted administrators and service accounts to limit who can invoke ethtool module flash operations
- Reboot affected hosts after patching to clear any leaked references accumulated in the running kernel
Patch Information
The fix is available in the mainline Linux kernel and has been backported to stable branches. See the upstream commits: Kernel Git Commit 61848c83, Kernel Git Commit 956b134d, Kernel Git Commit f7b4513e, and Kernel Git Commit fb7f511d. Consume the fix through your Linux distribution's regular kernel update channel.
Workarounds
- Avoid invoking ethtool module firmware flash operations on unpatched systems until the fix is applied
- Limit access to netlink ETHTOOL_MSG_MODULE_FW_FLASH_ACT interfaces via seccomp or LSM policies where feasible
- Schedule interface maintenance windows to reboot hosts after any observed failed flash attempts to release leaked references
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
