What’s Vulnerable › Vulnerabilities

CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-13
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors module_flash_fw_schedule() is missing undo for setting the "in_progress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we are holding rtnl_lock.

Affected products

• Linux kernel: from 6.11 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5 — fixed in 6.12.93, 6.18.35, 7.0.12

How to fix

Upgrade to a fixed version: Linux kernel 6.12.93, 6.18.35, 7.0.12. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/61848c83b9132ab839809fe415ba7802a0aca4f6
• https://git.kernel.org/stable/c/956b134d917fd7e014dc7e39a9b7610c04fcc9ba
• https://git.kernel.org/stable/c/f7b4513e77f9571dc1041a798b93b5c4a4bfc191
• https://git.kernel.org/stable/c/fb7f511d62692661846c47f199e0afe25c2982db

Get alerted when CVE-2026-63997 or the next vulnerability affects your stack