CVE-2026-63997

What it actually does

Missing error handling in module_flash_fw_schedule() causes a netdev reference leak and leaves the in_progress flag set when module flash operations fail, under rtnl_lock.

Why it matters to the business

Accumulated leaks can exhaust kernel memory resources, resulting in network instability, degraded performance, or system crashes affecting connected devices and services.

How an attack unfolds

A local attacker repeatedly triggers failing ethtool module flash operations; each failure skips cleanup of the netdev reference and in_progress flag, allowing leaks to accumulate until a use-after-free or exhaustion condition occurs when the device is later removed.

How to fix it

Update the Linux kernel to a version containing the fix that delays acquisition of the netdev reference and in_progress flag until after rtnl_lock guarantees the device cannot disappear.

How to confirm the fix worked

Inspect the module_flash_fw_schedule() implementation in the updated kernel source to verify that netdev references and the in_progress flag are acquired only after error paths are protected and released on all failure cases.

Typical attack path

1. Gain local user access on a Linux system
2. Invoke ethtool commands that initiate module firmware flash sequences crafted to return errors
3. Repeat the failing operations to accumulate leaked references
4. Trigger netdev removal or interface teardown to convert the leak into a use-after-free

How to detect it

Search kernel logs and dmesg output for repeated module flash error messages paired with missing reference-release traces; enable and review kmemleak reports for netdev objects.

What your security team should do

• Prioritize kernel updates on all affected systems
• Restrict ethtool usage to administrative accounts via file permissions or SELinux policies
• Enable kernel memory leak detectors and monitor for netdev reference warnings