Linux Kernel Vulnerability in Ethtool Module Related to Netdev Reference Management

CVE-2026-63997

What is CVE-2026-63997?

A vulnerability in the Linux kernel's ethtool module has been identified, which involves improper management of netdev references during module flash operations. Specifically, the function module_flash_fw_schedule() fails to appropriately undo the setting of the 'in_progress' flag and the acquisition of a netdev reference in the event of a flash error. This could potentially lead to security imperfections allowing devices to disappear while under lock, thereby complicating reference management and increasing the risk of system instability.

References