CVE-2026-64228: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo /sys/bus/mdiobus/drivers/...

The vulnerability of the ethtool_get_link_ksettings() function in the net/ethtool/ioctl.c module of the Linux kernel’s networking functions allows a hacker to cause a service failure.

The vulnerability of the ethtoolgetlinkksettings function in the net/ethtool/ioctl.c module of the Linux kernel’s networking functions relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the eeprom_prepare_data() function in the net/ethtool/eeprom.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the eeprompreparedata function in the net/ethtool/eeprom.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

CVE-2026-63995

A flaw was found in the Linux kernel's ethtool CMIS firmware update code. A malicious module or a corrupted response can provide an oversized payload size during the firmware update process. This can lead to an out-of-bounds write, allowing an attacker to corrupt memory. This memory corruption...

CVE-2026-63996

A flaw was found in the Linux kernel's ethtool CMIS Common Management Interface Specification module. A malicious SFP Small Form-Factor Pluggable module could provide a reply with a length longer than expected, leading to an out-of-bounds write. This vulnerability can result in memory corruption...

CVE-2026-63987

A flaw was found in the Linux kernel's ethtool subsystem. The ethnlupdateprofile function, responsible for updating profile settings, does not properly validate user-controlled input when processing Netlink nest lists. This allows a local attacker to cause an out-of-bounds write, potentially...

CVE-2026-63986

A flaw was found in the Linux kernel's ethtool: tsinfo component. This vulnerability occurs when the ethnltsinfopreparedump function fails to properly initialize a generic netlink message genlmsg but still attempts to cancel it by passing an error pointer. This improper error handling can lead to...

CVE-2026-63985

A flaw was found in the Linux kernel's ethtool component, specifically within the EEPROM Netlink fallback path. The fallbacksetparams function fails to properly validate the length of data being read from the module's EEPROM, allowing for an out-of-bounds read. Additionally, the eepromfallback...

CVE-2026-63998

A flaw was found in the Linux kernel's ethtool module. When attempting to flash transceiver modules' firmware, a validation failure could cause the ethnlopscomplete function to be skipped. This oversight means that an operation initiated by ethnlopsbegin might not be properly concluded, potential...

CVE-2026-63999

A flaw was found in the Linux kernel's ethtool subsystem, specifically within the Receive Side Scaling RSS functionality. The rssprepareget function fails to deallocate memory for the indirection table and hash key buffer if an internal operation ops-getrxfh does not complete successfully. This...

SUSE CVE-2026-63985

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...

SUSE CVE-2026-63986

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...

SUSE CVE-2026-63987

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

SUSE CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

SUSE CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

SUSE CVE-2026-63997

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors moduleflashfwschedule is missing undo for setting the "inprogress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we a...

SUSE CVE-2026-63998

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: call ethnlopscomplete on module flash errors When validate fails we are skipping over ethnlopscomplete even tho we already called ethnlopsbegin...

SUSE CVE-2026-63999

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...

SUSE CVE-2026-64121

In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over numtxqueues ifbdevinit allocates dp-txprivate to dev-numtxqueues entries via kzallocobjstxp, dev-numtxqueues. Both IFB per-queue RX and TX stats live in those entries: ifbxmit updates txp-rxsta...

CVE-2026-63997

A flaw was found in the ethtool module of the Linux kernel. The moduleflashfwschedule function fails to properly undo the setting of the 'inprogress' flag and the taking of the netdev reference during module flash errors. This oversight can lead to a resource leak, preventing the device from bein...