CVE-2026-63985

A flaw was found in the Linux kernel's ethtool component, specifically within the EEPROM Netlink fallback path. The fallback_set_params() function fails to properly validate the length of data being read from the module's EEPROM, allowing for an out-of-bounds read. Additionally, the eeprom_fallback() function uses an uninitialized memory buffer, which could lead to the disclosure of sensitive kernel memory information. This vulnerability could result in unexpected behavior in device drivers and firmware, and potentially expose internal kernel data.

An ethtool Netlink EEPROM fallback bug allows a local user to request a module EEPROM range where offset is valid but offset plus length exceeds the advertised EEPROM size. The fallback path can pass an out of range request to drivers or device firmware and can also expose data from a kmalloc buffer if a driver returns fewer initialized bytes than requested. For the CVSS the PR:L is used because a local user or local process is required to issue the ethtool Netlink request, while full administrator privileges are not clearly required for the get path. The issue is not directly network reachable. Impact is mainly local information disclosure and limited availability risk from driver or firmware error handling, with no clear privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.