CVE-2026-63997
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/07/2026
Last modified:
30/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ethtool: module: avoid leaking a netdev ref on module flash errors<br />
<br />
module_flash_fw_schedule() is missing undo for setting<br />
the "in_progress" flag and taking the netdev reference.<br />
Delay taking these, the device can&#39;t disappear while<br />
we are holding rtnl_lock.