CVE-2026-64526: Linux Kernel Ethtool Tsconfig Vulnerability

CVE-2026-64526 Overview

CVE-2026-64526 is a Linux kernel vulnerability in the ethtool subsystem. The flaw resides in the tsconfig_prepare_data() function, which calls ethnl_ops_begin() but fails to call the matching ethnl_ops_complete() before returning on an error path. This creates an unbalanced operations state within the ethtool netlink handling logic for timestamp configuration (tsconfig).

Critical Impact
The missing ethnl_ops_complete() call leaves ethtool netlink operations in an inconsistent state on error, which can lead to resource leaks or improper locking behavior in the kernel networking stack.

Affected Products

Linux kernel versions containing the ethtool tsconfig netlink handler
Upstream Linux kernel prior to the fix commits
Downstream distributions rebasing on affected stable branches

Discovery Timeline

2026-07-25 - CVE-2026-64526 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64526

Vulnerability Analysis

The vulnerability exists in the Linux kernel ethtool netlink interface, specifically in the tsconfig (timestamp configuration) code path. The function tsconfig_prepare_data() begins an ethtool netlink operation by calling ethnl_ops_begin(). This function establishes required state, such as acquiring a reference to the network device operations context.

The expected pattern requires every successful ethnl_ops_begin() invocation to be paired with an ethnl_ops_complete() call to release that state. In the flawed code path, an error branch returns without calling ethnl_ops_complete(), breaking the acquire/release symmetry.

Unbalanced acquire/release in kernel code can lead to reference count leaks, stuck locks, or lingering device operational state. Repeated triggering of the error path could exhaust resources or leave the ethtool subsystem in a degraded condition affecting subsequent ethtool operations on the affected interface.

Root Cause

The root cause is a missing cleanup call on an error return path in tsconfig_prepare_data(). The function acquires operational context through ethnl_ops_begin() but exits early on failure without invoking the corresponding ethnl_ops_complete(). This is a resource management defect commonly categorized under improper release of resources.

Attack Vector

Triggering the code path requires the ability to issue ethtool netlink requests for timestamp configuration against a network interface. A local user with sufficient privileges to invoke ethtool operations could repeatedly trigger the error condition. No public exploit is available for CVE-2026-64526, and the flaw has not been observed in active exploitation.

The vulnerability is described in prose because no verified public exploit code exists. See the upstream commits 6386bd77, d02342d9, and d53fe379 for the exact source-level changes.

Detection Methods for CVE-2026-64526

Indicators of Compromise

Repeated ethtool netlink tsconfig requests from unprivileged or unexpected local processes
Kernel log entries indicating stalled or unresponsive ethtool operations on network interfaces
Unexpected reference count anomalies on network device structures observed via kernel debugging facilities

Detection Strategies

Audit the running kernel version against the fix commits 6386bd77, d02342d9, and d53fe379 on git.kernel.org
Monitor auditd records for ethtool syscall invocations targeting ETHTOOL_MSG_TSCONFIG_GET or related netlink operations
Baseline normal ethtool activity per host and flag repeated tsconfig requests that produce errors

Monitoring Recommendations

Ingest kernel and audit logs into a centralized analytics pipeline for correlation across hosts
Alert on anomalous rates of ethtool netlink errors returned to userspace
Track kernel package versions across the Linux fleet to identify hosts still running unpatched builds

How to Mitigate CVE-2026-64526

Immediate Actions Required

Identify Linux hosts running kernel versions that predate the fix commits referenced in the NVD entry
Apply the vendor-supplied kernel update from your distribution once available
Restrict local access on multi-tenant hosts to reduce the attack surface for local-only kernel flaws

Patch Information

The issue is resolved in the upstream Linux kernel by ensuring tsconfig_prepare_data() calls ethnl_ops_complete() before returning on the error path. The relevant commits are Kernel Git Commit 6386bd7, Kernel Git Commit d02342d9, and Kernel Git Commit d53fe379. Rebuild and reboot into the patched kernel to remediate.

Workarounds

Limit local access on shared Linux hosts to trusted users to reduce the ability to invoke ethtool operations
Where feasible, restrict CAP_NET_ADMIN grants that permit ethtool netlink operations to only required service accounts
Prioritize kernel updates on systems where untrusted local workloads may issue ethtool commands

bash

# Verify installed kernel version and check for fix commits
uname -r
# On distributions with source available, confirm the fix is present
grep -n "ethnl_ops_complete" net/ethtool/tsconfig.c