Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could allow a local user to cause a system crash or instability. The issue exists in the ethtool component, which manages network interface settings, where certain user-provided configuration lists were not properly limited in size. An attacker could exploit this to overwrite kernel memory, potentially leading to a denial of service.
Technical details
A heap-based buffer overflow exists in net/ethtool/coalesce.c within the ethnl_update_profile() function. The function iterates through the ETHTOOL_A_PROFILE_IRQ_MODERATION nested list provided via Netlink and writes to a destination buffer (new_profile) that is fixed at NET_DIM_PARAMS_NUM_PROFILES (5) entries. Because the Netlink nest count is user-controlled and the loop index 'i' was not bounded, an attacker can trigger out-of-bounds writes. This requires local access to send Netlink messages. The issue has been resolved by adding a check to ensure the index does not exceed the allocated buffer size, returning -E2BIG if the limit is reached.
Affected products
- Linux Linux Kernel 6.11 to 7.1
Timeline
- 2026-05-26: patched: Initial fix commit by Jakub Kicinski
- 2026-07-19: advisory: NVD publication date