---
id: CVE-2026-63985
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ethtool: eeprom: add more safeties to EEPROM Netlink fallback

  The Netlink fallback path for reading module EEPROM
  (fallback_set_params()) validates that offset < eepro…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ethtool: eeprom: add more safeties to EEPROM Netlink fallback

  The Netlink fallback path for reading module EEPROM
  (fallback_set_params()) validates that offset < eepro…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.13, < 5.15.210'
  - 'linux_kernel >= 5.16, < 6.1.176'
  - 'linux_kernel >= 6.2, < 6.6.143'
  - 'linux_kernel >= 6.7, < 6.12.93'
  - 'linux_kernel >= 6.13, < 6.18.35'
  - 'linux_kernel >= 6.19, < 7.0.12'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.12
published: '2026-07-19'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:51:41.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63985'
references:
  - url: 'https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00129
epssPercentile: 0.02191
ingestedAt: '2026-10-07T21:54:15.078Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ethtool: eeprom: add more safeties to EEPROM Netlink fallback

The Netlink fallback path for reading module EEPROM
(fallback_set_params()) validates that offset < eeprom_len,
but does not check that offset + length stays within eeprom_len.
The ioctl equivalent (ethtool_get_any_eeprom() in ioctl.c) has
always enforced both bounds:

  if (eeprom.offset + eeprom.len > total_len)
      return -EINVAL;

This could lead to surprises in both drivers and device FW.
Add the missing offset + length validation to fallback_set_params(),
mirroring the ioctl.

Similarly - ethtool core in general, and ethtool_get_any_eeprom()
in particular tries to zero-init all buffers passed to the drivers
to avoid any extra work of zeroing things out. eeprom_fallback()
uses a plain kmalloc(), change it to zalloc.

## Affected

- `linux_kernel >= 5.13, < 5.15.210`
- `linux_kernel >= 5.16, < 6.1.176`
- `linux_kernel >= 6.2, < 6.6.143`
- `linux_kernel >= 6.7, < 6.12.93`
- `linux_kernel >= 6.13, < 6.18.35`
- `linux_kernel >= 6.19, < 7.0.12`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.12`