Strix
26.1K

CVE-2026-63999

UnknownEPSS 0.17%

Last modified

CVE-2026-63999 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.

Metrics

EPSS Probability
0.17%

6.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4f038a6a02d20859a3479293cbf172b0f14cbdd6, < 33d05c22d6f227c5ae171c46df2f6f8bf48047ea; >= 4f038a6a02d20859a3479293cbf172b0f14cbdd6, < 80d95d92f828cfcace955d673637d944178b435f; >= 4f038a6a02d20859a3479293cbf172b0f14cbdd6, < 266297692f97008ca48bc311775c087c59bd7fe3; 81a5174e64ce4fb7b7a2f6499b835c904c9451ee; ec9faff49a4ea27731de39cb887b7e590e93157b; c5ed0eaddcbda56079091fc3876b140a6e70a548; a065b996052656a65afc51ad82336dc55ae4c72f; adee9db710a6117b978a25ed4153846b7c56ec9a; 5eb3fdc4b6281b29e830300c866a36d90442b1f0; >= 5.15.181, < 5.16; >= 6.1.135, < 6.2; >= 6.6.88, < 6.7; >= 6.12.24, < 6.13; >= 6.13.12, < 6.14; >= 6.14.3, < 6.15
LinuxLinux6.15

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-63999?
In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.
How severe is CVE-2026-63999?
Severity scoring for CVE-2026-63999 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-63999?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-63999?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST