CVE-2026-68440

net: txgbe: fix heap overflow when reading module EEPROM

State: Published
Severity: 7.8 High
Published: Aug 12, 2026
Updated: Aug 17, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: fix heap overflow when reading module EEPROM

txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-aligned length therefore causes an out-of-bounds write. Copy only the remaining bytes on the final dword instead.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9b97b6b5635b3de18debd07a3adcf25198ec8299 to before febcced6958158e7e90a55a8567b3f5c3639c0b9Affected 9b97b6b5635b3de18debd07a3adcf25198ec8299 to before 6a905a71fd43ce8b45f05044b11491337f232c9dAffected
LinuxLinux	6.19Affected before 6.19Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.