SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-63987

HIGH · CVSS 7.8 EPSS 0.13%

Source: NVD + CISA KEV + EPSS · Published 2026-07-19 · Last synced 2026-08-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's ethtool component, specifically in the handling of IRQ moderation profile updates, where an unbounded index can lead to memory corruption. This flaw allows an attacker to exploit user-controlled input, potentially leading to denial of service or arbitrary code execution. Organizations using Linux systems, particularly those relying on network management features, should prioritize patching to mitigate the risk associated with this high-severity vulnerability.

CVE
CVE-2026-63987
Severity
HIGH
CVSS
7.8
EPSS
0.13%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).