Executive brief
The Linux kernel's txgbe network driver contains a heap overflow vulnerability in its module EEPROM reading function. When ethtool reads EEPROM data via this driver, the function copies more bytes than the allocated buffer can hold, potentially allowing local attackers to corrupt kernel memory. This could lead to privilege escalation, system crashes, or data corruption on systems using Wangxun txgbe network adapters.
Technical details
The vulnerability exists in txgbe_read_eeprom_hostif() in drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c. The function always copies round_up(length, 4) bytes into the caller-provided buffer, but ethtool allocates exactly 'length' bytes. For non-4-aligned lengths, this causes an out-of-bounds heap write. The root cause is the unconditional 4-byte alignment in the memcpy operation without adjusting the copy length for the final dword. Local code execution is possible if an attacker can trigger EEPROM reads via ethtool with a crafted length. The fix limits the final copy to only the remaining bytes needed rather than always copying 4 bytes per iteration.
Affected products
- Linux Linux kernel All versions with txgbe driver support (kernel 5.2 and later)
Timeline
- 2026-08-12: disclosed: CVE-2026-68440 published
- 2026-07-21: patched: Upstream fix merged (commit 6a905a71fd43ce8b45f05044b11491337f232c9d)