Bug 2514447 (CVE-2026-68440) - CVE-2026-68440 kernel: net: txgbe: fix heap overflow when reading module EEPROM
Summary: CVE-2026-68440 kernel: net: txgbe: fix heap overflow when reading module EEPROM
Keywords:
Status: NEW
Alias: CVE-2026-68440
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-12 00:21 UTC by OSIDB Bzimport
Modified: 2026-08-13 09:12 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-12 00:21:55 UTC
In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: fix heap overflow when reading module EEPROM

txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes
into the caller buffer, which ethtool allocates with exactly 'length'
bytes. A non-4-aligned length therefore causes an out-of-bounds write.
Copy only the remaining bytes on the final dword instead.

Comment 1 Mauro Matteo Cascella 2026-08-12 15:24:37 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081256-CVE-2026-68440-3dc6@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.