In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors… (CVE-2026-63997)
A vulnerability in the Linux kernel's ethtool module was resolved that involved leaking a network device reference during module flash errors. The issue was due to missing undo operations for setting an "in_progress" flag and taking a netdev reference in the module_flash_fw_schedule() function. This fix delays these operations to prevent the device from disappearing while holding the rtnl_lock.
AI Analysis
Technical Summary
The Linux kernel ethtool module contained a flaw where the module_flash_fw_schedule() function did not properly undo setting the "in_progress" flag and taking a network device reference upon module flash errors. This could lead to leaking a netdev reference. The resolution involved delaying these actions to ensure the device remains valid while rtnl_lock is held, preventing reference leaks.
Potential Impact
The vulnerability could cause a leak of a network device reference in the kernel, potentially leading to resource mismanagement or stability issues. No information indicates active exploitation or direct security compromise such as privilege escalation or denial of service.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability. Since no patch links or vendor advisories are provided, users should update to the latest Linux kernel versions where this issue is resolved. Patch status is not yet confirmed in the provided data—check the official Linux kernel advisories or repositories for the specific fix.
In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors… (CVE-2026-63997)
Description
A vulnerability in the Linux kernel's ethtool module was resolved that involved leaking a network device reference during module flash errors. The issue was due to missing undo operations for setting an "in_progress" flag and taking a netdev reference in the module_flash_fw_schedule() function. This fix delays these operations to prevent the device from disappearing while holding the rtnl_lock.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel ethtool module contained a flaw where the module_flash_fw_schedule() function did not properly undo setting the "in_progress" flag and taking a network device reference upon module flash errors. This could lead to leaking a netdev reference. The resolution involved delaying these actions to ensure the device remains valid while rtnl_lock is held, preventing reference leaks.
Potential Impact
The vulnerability could cause a leak of a network device reference in the kernel, potentially leading to resource mismanagement or stability issues. No information indicates active exploitation or direct security compromise such as privilege escalation or denial of service.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability. Since no patch links or vendor advisories are provided, users should update to the latest Linux kernel versions where this issue is resolved. Patch status is not yet confirmed in the provided data—check the official Linux kernel advisories or repositories for the specific fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hhv3-q8wp-5p98
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63997"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912deea
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:01:25 UTC
Last updated: 07/20/2026, 17:26:47 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.