{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63985", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.025Z", "datePublished": "2026-07-19T14:56:07.527Z", "dateUpdated": "2026-07-20T13:42:05.985Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:42:05.985Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\n\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\n\n if (eeprom.offset + eeprom.len > total_len)\n return -EINVAL;\n\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\n\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/eeprom.c"], "versions": [{"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "0e182689831277faf2ef683573a60474c208f690", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "65674d2489a12b8efd2ca0effb3de1d12224b596", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "d81376053a00865c70b8d8506a1cb93f2943d413", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "fd0de51c54fa8474a0ddeedd71c65ad09fada390", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "4fe1bc4b3603f621240d5b401742f302190db769", "status": "affected", "versionType": "git"}, {"version": "96d971e307cc0e434f96329b42bbd98cfbca07d2", "lessThan": "67cfdd9210b99f260b3e0afeb9525e0acc7be31e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/eeprom.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690"}, {"url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1"}, {"url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596"}, {"url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413"}, {"url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390"}, {"url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769"}, {"url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e"}], "title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "id": "2502340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502340"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nethtool: eeprom: add more safeties to EEPROM Netlink fallback\nThe Netlink fallback path for reading module EEPROM\n(fallback_set_params()) validates that offset < eeprom_len,\nbut does not check that offset + length stays within eeprom_len.\nThe ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has\nalways enforced both bounds:\nif (eeprom.offset + eeprom.len > total_len)\nreturn -EINVAL;\nThis could lead to surprises in both drivers and device FW.\nAdd the missing offset + length validation to fallback_set_params(),\nmirroring the ioctl.\nSimilarly - ethtool core in general, and ethtool_get_any_eeprom()\nin particular tries to zero-init all buffers passed to the drivers\nto avoid any extra work of zeroing things out. eeprom_fallback()\nuses a plain kmalloc(), change it to zalloc.", "A flaw was found in the Linux kernel's ethtool component, specifically within the EEPROM Netlink fallback path. The fallback_set_params() function fails to properly validate the length of data being read from the module's EEPROM, allowing for an out-of-bounds read. Additionally, the eeprom_fallback() function uses an uninitialized memory buffer, which could lead to the disclosure of sensitive kernel memory information. This vulnerability could result in unexpected behavior in device drivers and firmware, and potentially expose internal kernel data."], "name": "CVE-2026-63985", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63985\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63985\nhttps://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63985-56d0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,0e182689831277faf2ef683573a60474c208f690)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,65674d2489a12b8efd2ca0effb3de1d12224b596)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,d81376053a00865c70b8d8506a1cb93f2943d413)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,fd0de51c54fa8474a0ddeedd71c65ad09fada390)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,4fe1bc4b3603f621240d5b401742f302190db769)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[96d971e307cc0e434f96329b42bbd98cfbca07d2,67cfdd9210b99f260b3e0afeb9525e0acc7be31e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T06:30:02.541963+00:00", "updated": "2026-07-21T23:00:05.166338+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125", "CWE-20", "CWE-788"]}