CVE-2026-63999

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Oct 21, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c5ed0eaddcbda56079091fc3876b140a6e70a548 to before 14dbf22c397b799b3a80f63fc90c2fc0585bbeb3Affected a065b996052656a65afc51ad82336dc55ae4c72f to before 323faef6366349f57d4ad67d318a0c8906e360b3Affected 4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 33d05c22d6f227c5ae171c46df2f6f8bf48047eaAffected 4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 80d95d92f828cfcace955d673637d944178b435fAffected 4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 266297692f97008ca48bc311775c087c59bd7fe3Affected 81a5174e64ce4fb7b7a2f6499b835c904c9451eeAffected ec9faff49a4ea27731de39cb887b7e590e93157bAffected adee9db710a6117b978a25ed4153846b7c56ec9aAffected 5eb3fdc4b6281b29e830300c866a36d90442b1f0Affected 6.6.88 to before 6.6.160Affected 6.12.24 to before 6.12.114Affected 5.15.181 to before 5.16Affected 6.1.135 to before 6.2Affected 6.13.12 to before 6.14Affected 6.14.3 to before 6.15Affected
LinuxLinux	6.15Affected before 6.15Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c5ed0eaddcbda56079091fc3876b140a6e70a548 to before 14dbf22c397b799b3a80f63fc90c2fc0585bbeb3Affected
a065b996052656a65afc51ad82336dc55ae4c72f to before 323faef6366349f57d4ad67d318a0c8906e360b3Affected
4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 33d05c22d6f227c5ae171c46df2f6f8bf48047eaAffected
4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 80d95d92f828cfcace955d673637d944178b435fAffected
4f038a6a02d20859a3479293cbf172b0f14cbdd6 to before 266297692f97008ca48bc311775c087c59bd7fe3Affected
81a5174e64ce4fb7b7a2f6499b835c904c9451eeAffected
ec9faff49a4ea27731de39cb887b7e590e93157bAffected
adee9db710a6117b978a25ed4153846b7c56ec9aAffected
5eb3fdc4b6281b29e830300c866a36d90442b1f0Affected
6.6.88 to before 6.6.160Affected
6.12.24 to before 6.12.114Affected
5.15.181 to before 5.16Affected
6.1.135 to before 6.2Affected
6.13.12 to before 6.14Affected
6.14.3 to before 6.15Affected

LinuxLinux

6.15Affected
before 6.15Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.