Vulnerability in Linux Kernel Affecting EEPROM Netlink Functionality

CVE-2026-63985

What is CVE-2026-63985?

A vulnerability in the Linux kernel's eeprom Netlink fallback method has been identified, which fails to properly validate the combined offset and length. This oversight may lead to unexpected behavior in drivers and device firmware, potentially causing system instability. The issue has been rectified by implementing additional checks to ensure that the sum of the offset and length remains within permissible limits. Furthermore, improvements have been made to buffer initialization routines, enhancing overall security.

References