CVE-2026-63987 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without
bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists in the linux kernel's ethtool implementation where the ethnl_update_profile() function processes user-controlled netlink data without proper bounds checking on nested attribute counts. The function iterates through ETHTOOL_A_PROFILE_IRQ_MODERATION nest lists using an index variable 'i' that increments with each iteration but lacks any upper bound validation. While the destination buffer is allocated to accommodate exactly NET_DIM_PARAMS_NUM_PROFILES entries (currently set to 5), the actual number of nested elements in the netlink message can be arbitrarily large as determined by user input. This creates a classic out-of-bounds write condition where maliciously crafted netlink messages could cause the kernel to write beyond allocated memory boundaries, potentially leading to memory corruption and system instability.
The technical flaw manifests in the absence of proper input validation for nested netlink attributes within the ethtool subsystem. The kernel's netlink policy mechanisms do not provide built-in support for constraining the number of nested entries or multi-attribute entries in the data structures being processed, leaving this critical bounds checking to be implemented manually by developers. When the function processes the user-provided netlink data, it blindly increments its index variable without verifying that the index remains within the allocated buffer limits. This design gap allows an attacker with access to the ethtool interface to submit a netlink message containing an excessive number of nested elements, causing the kernel to write beyond the intended 5-element array boundary established by kmemdup().
The operational impact of this vulnerability is significant as it represents a potential path to privilege escalation or system compromise through kernel memory corruption. An attacker could exploit this flaw by crafting malicious netlink messages that trigger the out-of-bounds write condition, potentially leading to denial of service attacks or more severe consequences depending on the specific memory locations overwritten. The vulnerability affects systems running linux kernels where ethtool functionality is available and accessible, particularly those with network interface management capabilities. Since ethtool operations often require elevated privileges, this could provide a vector for privilege escalation if exploited successfully.
Mitigation strategies should focus on implementing proper bounds checking within the ethnl_update_profile() function to ensure that the index variable does not exceed the allocated buffer size of NET_DIM_PARAMS_NUM_PROFILES entries. The kernel code must validate the number of nested attributes before processing them and enforce strict limits on the maximum number of elements allowed in the profile update operations. Additionally, defensive programming practices should be adopted to prevent similar issues across other netlink handlers by ensuring that all user-controlled attribute counts are properly validated against allocated buffer sizes. This vulnerability aligns with CWE-129 Input Validation and Validation of Count Fields and is categorized under ATT&CK technique T1068, which covers privilege escalation through kernel vulnerabilities, making it a critical security concern requiring immediate patching.