{"id":"CVE-2026-68440","state":"PUBLISHED","title":"net: txgbe: fix heap overflow when reading module EEPROM","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix heap overflow when reading module EEPROM\n\ntxgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes\ninto the caller buffer, which ethtool allocates with exactly 'length'\nbytes. A non-4-aligned length therefore causes an out-of-bounds write.\nCopy only the remaining bytes on the final dword instead.","publishedAt":"2026-08-12T00:07:29.605Z","updatedAt":"2026-08-17T05:05:37.444Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9b97b6b5635b3de18debd07a3adcf25198ec8299","status":"affected","lessThan":"febcced6958158e7e90a55a8567b3f5c3639c0b9","versionType":"git"},{"version":"9b97b6b5635b3de18debd07a3adcf25198ec8299","status":"affected","lessThan":"6a905a71fd43ce8b45f05044b11491337f232c9d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"]}],"references":["https://git.kernel.org/stable/c/febcced6958158e7e90a55a8567b3f5c3639c0b9","https://git.kernel.org/stable/c/6a905a71fd43ce8b45f05044b11491337f232c9d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68440.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68440","state":"PUBLISHED","datePublished":"2026-08-12T00:07:29.605Z","dateUpdated":"2026-08-17T05:05:37.444Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.394Z"},"containers":{"cna":{"title":"net: txgbe: fix heap overflow when reading module EEPROM","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: txgbe: fix heap overflow when reading module EEPROM\n\ntxgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes\ninto the caller buffer, which ethtool allocates with exactly 'length'\nbytes. A non-4-aligned length therefore causes an out-of-bounds write.\nCopy only the remaining bytes on the final dword instead."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"9b97b6b5635b3de18debd07a3adcf25198ec8299","status":"affected","lessThan":"febcced6958158e7e90a55a8567b3f5c3639c0b9","versionType":"git"},{"version":"9b97b6b5635b3de18debd07a3adcf25198ec8299","status":"affected","lessThan":"6a905a71fd43ce8b45f05044b11491337f232c9d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.19","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/febcced6958158e7e90a55a8567b3f5c3639c0b9"},{"url":"https://git.kernel.org/stable/c/6a905a71fd43ce8b45f05044b11491337f232c9d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is triggered through the ethtool genetlink interface (ETHTOOL_MSG_MODULE_EEPROM_GET) from a local socket; no network packet or remote peer data reaches the vulnerable copy loop.\nAC:L - The attacker fully controls the request length attribute (policy allows 1..128 with no alignment constraint), so any non-4-aligned value deterministically triggers the over-copy on every call, repeatably and without racing.\nPR:L - The ethtool op is gated by GENL_UNS_ADMIN_PERM, i.e. ns-capable CAP_NET_ADMIN in the user namespace owning the netdev's netns, which an unprivileged user can obtain via unshare -Urn rather than real root.\nUI:N - The attacker issues the ethtool netlink request directly; no victim action, module plug event, or administrator step is needed.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow is a heap memory-corruption primitive adjacent to attacker-groomable slab objects, and corrupting neighbouring object metadata (lengths, pointers) can be leveraged to disclose arbitrary kernel memory back through the same ethtool reply.\nI:H - This is an out-of-bounds heap write with firmware/module-supplied bytes past the end of a caller-sized kmalloc buffer, giving an attacker-triggerable corruption of adjacent kernel data that can be steered toward control-flow hijacking.\nA:H - Corrupting adjacent slab objects or allocator metadata leads to kernel oops/panic, and on KASAN or hardened configurations the slab-out-of-bounds write itself aborts the kernel, so a repeatable denial of service is available."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:05:37.444Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}