CVE-2026-63987

A flaw was found in the Linux kernel's ethtool subsystem. The ethnl_update_profile() function, responsible for updating profile settings, does not properly validate user-controlled input when processing Netlink nest lists. This allows a local attacker to cause an out-of-bounds write, potentially leading to a denial of service or other memory corruption issues.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and the capability to send crafted network administrative Netlink requests to the host kernel. Under standard configurations, modifying network device moderation settings is restricted to privileged users or processes, preventing untrusted remote parties from directly reaching the affected code path. While successful manipulation of these requests can result in kernel memory corruption or an operating system crash, the prerequisite local permissions significantly limit the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.