CVE-2026-63987 | In the Linux kernel, the following vulnerability has been re… | CVSS 7.8 HIGH

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).

Metadata

CVE ID: CVE-2026-63987
State: PUBLISHED
Assigner: Linux
Reserved: 2026-07-19 07:54 UTC
Published: 2026-07-19 14:56 UTC
Last updated: 2026-07-20 13:42 UTC
Vendor / Product: Linux / Linux
Sources: cve.org · NVD

Severity & Metrics

7.8 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products (2)

Vendor	Product	Platform	Versions
Linux	Linux	—	f750dfe825b904164688adeb147950e0e0c4d262 < d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc, f750dfe825b904164688adeb147950e0e0c4d262 < 0c02c190bcd9822477038ff2cee10ea584ac1b1d, f750dfe825b904164688adeb147950e0e0c4d262 < 6205f7166d2dd14a017a5802c81e5bd1421a8635, f750dfe825b904164688adeb147950e0e0c4d262 < 7281b096b072f6c6e30420e3467d738f2e4c4b57
Linux	Linux	—	6.11, 0 < 6.11, 6.12.93 ≤ 6.12., 6.18.35 ≤ 6.18. …

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.8	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (4)