CVE-2026-63999: Linux Kernel Information Disclosure Flaw

CVE-2026-63999 Overview

CVE-2026-63999 is a memory leak vulnerability in the Linux kernel's ethtool Receive Side Scaling (RSS) subsystem. The flaw resides in the rss_prepare_get() function, which handles requests for RSS configuration data. The function allocates memory for the indirection table and hash key buffer through rss_get_data_alloc() before invoking the driver's ops->get_rxfh() callback to populate them. When get_rxfh() returns an error, the function exits without freeing the previously allocated buffers, causing a kernel memory leak on every failed call.

Critical Impact
Repeated failed RSS query operations can exhaust kernel memory, leading to degraded system stability and potential denial-of-service conditions on affected Linux hosts.

Affected Products

Linux kernel versions containing the vulnerable rss_prepare_get() implementation in the ethtool RSS code path
Systems using network drivers that expose the get_rxfh ethtool operation
Distributions shipping upstream kernels prior to the fix commits referenced by kernel.org

Discovery Timeline

2026-07-19 - CVE-2026-63999 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63999

Vulnerability Analysis

The vulnerability is a kernel memory leak in the ethtool RSS get path. The rss_prepare_get() function orchestrates the retrieval of RSS configuration by first allocating two buffers: the indirection table and the hash key. It uses rss_get_data_alloc() for these allocations and then calls the driver-provided ops->get_rxfh() operation to populate them with hardware-specific values.

When ops->get_rxfh() fails, rss_prepare_get() returns the error code directly to the caller. It does not release the buffers allocated moments earlier. Each failed invocation therefore leaks the memory associated with the indirection table and the hash key.

A local user with permission to issue ethtool RSS queries can trigger repeated failures against a driver whose get_rxfh implementation returns an error under attacker-controlled conditions. Sustained triggering drains kernel memory over time. The issue is classified as a Memory Leak defect in kernel networking code.

Root Cause

The root cause is missing cleanup on the error path. rss_prepare_get() allocates resources through rss_get_data_alloc() but lacks a corresponding goto-based unwind or explicit free call when ops->get_rxfh() returns non-zero. The allocation lifetime is not tied to the success path, breaking the standard kernel resource acquisition and release pattern.

Attack Vector

Exploitation requires local access with the capability to invoke ethtool netlink operations that resolve to rss_prepare_get(). An attacker repeatedly issues RSS get requests against interfaces or driver states where get_rxfh() fails. Each failure leaks the indirection table and hkey buffers. This attack does not yield code execution but can be used to exhaust kernel memory and destabilize the host.

No verified public exploit code is available. See the upstream fix commits 266297692f97, 33d05c22d6f2, and 80d95d92f828 for the corrected error-handling logic.

Detection Methods for CVE-2026-63999

Indicators of Compromise

Sustained growth in kernel slab memory usage without corresponding legitimate workload increases, observed via /proc/meminfo and /proc/slabinfo.
Repeated ethtool netlink RSS operations returning error codes in kernel audit or netlink logs on a single interface.
Progressive kernel memory pressure events, OOM conditions, or degraded networking behavior on hosts with high ethtool activity.

Detection Strategies

Monitor kernel version and package inventory against the fixed commits referenced by kernel.org stable trees.
Correlate userspace ethtool or netlink RSS API calls with kernel error returns to identify abuse patterns.
Baseline kernel memory allocation trends and alert on anomalies tied to networking subsystem slabs.

Monitoring Recommendations

Track SLAB and Slab/SReclaimable counters over time on Linux hosts and alert on unbounded growth.
Enable kernel audit rules covering ethtool syscalls and netlink socket operations from non-privileged contexts.
Ingest kernel logs and networking telemetry into a centralized data lake for longitudinal analysis and anomaly detection.

How to Mitigate CVE-2026-63999

Immediate Actions Required

Identify Linux hosts running kernels that predate the referenced stable fix commits and prioritize them for patching.
Restrict local access and limit which users or workloads can invoke ethtool RSS operations on production systems.
Monitor kernel memory usage closely on multi-tenant or exposed hosts until patched kernels are deployed.

Patch Information

Apply the upstream Linux kernel fixes distributed through the stable tree. The corrected rss_prepare_get() releases the indirection table and hash key buffers when ops->get_rxfh() fails. Reference commits: 266297692f97, 33d05c22d6f2, and 80d95d92f828. Rebuild or install distribution kernels that incorporate these commits and reboot affected systems.

Workarounds

Limit CAP_NET_ADMIN and general local access to trusted operators to reduce the population of users able to trigger RSS queries.
Disable or restrict management tooling that repeatedly invokes ethtool RSS operations on drivers known to fail get_rxfh().
Schedule periodic reboots or interface resets on unpatched hosts to reclaim leaked kernel memory until patches are applied.

bash

# Verify kernel version and confirm whether stable fix commits are present
uname -r
git -C /usr/src/linux log --oneline | grep -E '266297692f97|33d05c22d6f2|80d95d92f828'

# Monitor kernel slab memory for leak indicators
watch -n 5 'grep -E "^Slab|^SReclaimable|^SUnreclaim" /proc/meminfo'