CVE-2026-63987
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Jul 19, 2026
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's network configuration code lets a logged-in user send specially crafted commands that can take over the whole computer.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Unbounded index increment in ethnl_update_profile() allows user-controlled Netlink nested attributes to write past the end of a 5-entry kmemdup-allocated array for IRQ moderation profiles.
Why it matters to the business
Local attackers on affected Linux systems can gain kernel-level code execution, potentially compromising the entire host and any workloads running on it; low EPSS and absence from KEV indicate limited real-world exploitation so far but the 99-day-old flaw still requires prompt attention on servers and appliances using ethtool.
How an attack unfolds
An attacker with local access sends a crafted Netlink ETHTOOL_MSG_COALESCE_SET message containing more than five ETHTOOL_A_PROFILE_IRQ_MODERATION nested attributes; the kernel walks the list without bounds checking and performs out-of-bounds writes into the profile array, enabling memory corruption and privilege escalation.
How to fix it
Upgrade to a Linux kernel containing the upstream fix that enforces the NET_DIM_PARAMS_NUM_PROFILES limit before processing nested profile attributes; rebuild and reboot any systems using custom kernels.
How to confirm the fix worked
Confirm the running kernel contains the commit that adds bounds checking inside ethnl_update_profile(); attempt to apply a coalesce profile set operation with more than five nested moderation entries and verify it is now rejected.
Typical attack path
- Obtain local shell or user context on a Linux host
- Construct malicious Netlink message with excess nested IRQ moderation profile attributes
- Invoke ethtool or direct Netlink call to trigger ethnl_update_profile()
- Trigger out-of-bounds write to corrupt adjacent kernel memory
- Escalate to kernel code execution and full host compromise
How to detect it
Review audit logs or eBPF traces for unusual Netlink messages to the ethtool family with abnormally high numbers of nested IRQ moderation attributes; inspect kernel crash dumps for out-of-bounds writes originating from ethnl_update_profile().
What your security team should do
- Prioritize kernel updates on all multi-tenant or externally accessible Linux systems
- Restrict ethtool and CAP_NET_ADMIN privileges to trusted processes only
- Monitor kernel update channels for the specific ethtool coalesce fix
- Test the patched kernel in a staging environment before broad rollout
The record
In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|