CVE-2026-63997 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedule() is missing undo for setting the "in_progress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnl_lock.
A vulnerability in the Linux kernel's ethtool module can lead to a reference leak of the netdev object during firmware flashing operations. This issue arises because the function responsible for flashing module firmware does not properly manage the 'in_progress' flag or the netdev reference. As a result, the device cannot be removed while the operation is ongoing, potentially causing synchronization issues.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/61848c83b9132ab839809fe415ba7802a0aca4f6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/956b134d917fd7e014dc7e39a9b7610c04fcc9ba | kernel.org | Patch |
| https://git.kernel.org/stable/c/f7b4513e77f9571dc1041a798b93b5c4a4bfc191 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fb7f511d62692661846c47f199e0afe25c2982db | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.11, < 6.12.93 >= 6.13, < 6.18.35 >= 6.19, < 7.0.12 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | Initial Analysis | [email protected] |
| Jul 19, 2026 | New CVE Received | kernel.org |