CVE-2026-63986

Summary

In the Linux kernel, the following vulnerability has been resolved:

ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure

The goto err label leads to:

genlmsg_cancel(skb, ehdr);
return ret;

If ethnl_tsinfo_prepare_dump() failed, it has not started a genlmsg. There's nothing to cancel, and passing an error pointer to genlmsg_cancel() would cause a crash.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb9e3f7dc9ed95daeb83cfa45b821cacaa01aa906 < 2008f9bb1ede9b688624a241228b8e54fc74f0f6affected
LinuxLinuxb9e3f7dc9ed95daeb83cfa45b821cacaa01aa906 < d0d2c5ccd1de28368cebeef74d9c530a60eff9a5affected
LinuxLinuxb9e3f7dc9ed95daeb83cfa45b821cacaa01aa906 < c3fc9976f686f9a95baf87db9d387f218fd65394affected
LinuxLinux6.14affected
LinuxLinux0 < 6.14unaffected
LinuxLinux6.18.35 <= 6.18.*unaffected
LinuxLinux7.0.12 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References