Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the ethtool component used for managing network hardware. When an error occurs during the firmware flashing process of a network transceiver module, the system may fail to properly release internal resources. This could lead to system instability or resource exhaustion, potentially impacting the availability of network services on the affected machine.
Technical details
A resource management flaw exists in net/ethtool/module.c within the Linux kernel. The function ethnl_act_module_fw_flash() calls ethnl_ops_begin() to initialize an operation but fails to call the corresponding ethnl_ops_complete() if the ethnl_module_fw_flash_validate() check fails. This results in an unbalanced state where the kernel may hold onto locks or resources indefinitely. An attacker with sufficient privileges to trigger firmware flashing operations could potentially cause a denial of service or resource leak. The issue has been resolved by ensuring the completion routine is called on all error paths.
Affected products
- Linux Linux 6.11 to 7.1
Timeline
- 2026-05-22: other: Patch authored by Jakub Kicinski
- 2026-07-19: disclosed: CVE published to NVD dataset