CVE-2026-63999 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3
https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea
https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f

History

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.
Title		ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3 https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:17.383Z

Updated: 2026-07-19T14:56:17.383Z

Reserved: 2026-07-19T07:54:57.026Z

Link: CVE-2026-63999

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63999", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.026Z", "datePublished": "2026-07-19T14:56:17.383Z", "dateUpdated": "2026-07-19T14:56:17.383Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:56:17.383Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: rss: fix indir_table and hkey leak on get_rxfh failure\n\nrss_prepare_get() allocates the indirection table and hash key buffer\nvia rss_get_data_alloc(), then calls ops->get_rxfh() to populate them.\nIf get_rxfh() fails, the function returns an error without freeing\nthe allocation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/rss.c"], "versions": [{"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6", "lessThan": "33d05c22d6f227c5ae171c46df2f6f8bf48047ea", "status": "affected", "versionType": "git"}, {"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6", "lessThan": "80d95d92f828cfcace955d673637d944178b435f", "status": "affected", "versionType": "git"}, {"version": "4f038a6a02d20859a3479293cbf172b0f14cbdd6", "lessThan": "266297692f97008ca48bc311775c087c59bd7fe3", "status": "affected", "versionType": "git"}, {"version": "81a5174e64ce4fb7b7a2f6499b835c904c9451ee", "status": "affected", "versionType": "git"}, {"version": "ec9faff49a4ea27731de39cb887b7e590e93157b", "status": "affected", "versionType": "git"}, {"version": "c5ed0eaddcbda56079091fc3876b140a6e70a548", "status": "affected", "versionType": "git"}, {"version": "a065b996052656a65afc51ad82336dc55ae4c72f", "status": "affected", "versionType": "git"}, {"version": "adee9db710a6117b978a25ed4153846b7c56ec9a", "status": "affected", "versionType": "git"}, {"version": "5eb3fdc4b6281b29e830300c866a36d90442b1f0", "status": "affected", "versionType": "git"}, {"version": "5.15.181", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.135", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.88", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.12.24", "lessThan": "6.13", "status": "affected", "versionType": "semver"}, {"version": "6.13.12", "lessThan": "6.14", "status": "affected", "versionType": "semver"}, {"version": "6.14.3", "lessThan": "6.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/rss.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.181"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.135"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea"}, {"url": "https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f"}, {"url": "https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3"}], "title": "ethtool: rss: fix indir_table and hkey leak on get_rxfh failure", "x_generator": {"engine": "bippy-1.2.0"}}}}