CVE-2026-63999 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the linux kernel's ethtool subsystem where the rss_prepare_get() function fails to properly handle memory deallocation when the get_rxfh() operation encounters an error condition. The flaw occurs during the processing of receive side scaling configuration where the system allocates memory for both indirection table and hash key buffers through the rss_get_data_alloc() routine. When the subsequent ops->get_rxfh() call returns an error status, the allocated memory structures remain unclaimed, creating a memory leak scenario that can accumulate over time.
The technical implementation of this vulnerability stems from improper resource management within the kernel's network subsystem. The rss_prepare_get() function demonstrates a classic memory leak pattern where allocation occurs without corresponding deallocation in error paths. This type of flaw falls under the broader category of CWE-401: Improper Release of Memory and represents a failure in proper exception handling mechanisms. The vulnerability specifically affects the ethtool utility's ability to query receive flow hash configuration parameters, where the system attempts to retrieve hardware-specific RSS configuration data but fails to clean up allocated resources upon error conditions.
The operational impact of this memory leak can manifest as gradual system resource exhaustion, particularly in environments with frequent ethtool operations or high network traffic volumes. While individual leaks may be small, repeated invocations of the faulty code path can lead to significant memory consumption over time, potentially affecting system performance and stability. The vulnerability is particularly concerning in server environments where ethtool commands are frequently executed for network configuration management, as these operations may occur in automated monitoring scripts or configuration management workflows.
Mitigation strategies should focus on implementing proper error handling within the rss_prepare_get() function to ensure all allocated memory is freed regardless of the get_rxfh() outcome. The fix requires adding cleanup code in the error path to release memory allocated by rss_get_data_alloc() before returning the error status. This approach aligns with ATT&CK technique T1070.004: Indicator Removal on Host, where proper resource management prevents accumulation of system artifacts that could impact performance. System administrators should also implement monitoring for unusual memory consumption patterns in network-intensive applications and ensure kernel updates are applied promptly to address this memory leak vulnerability.