CVE-2026-63999

MediumCVSS 5.5/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

No affected versions have been published.

Timeline

Published
Jul 19, 2026
Last modified
Oct 21, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-64004.3The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and includingCVE-2026-640009.8In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling EnsurCVE-2026-640017.8In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error snd_pcm_oss_proCVE-2026-640027.8In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sCVE-2026-640037.5In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_CVE-2026-640047.8In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() andCVE-2026-640057.8In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hCVE-2026-640065.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix dst corruption in same register operation FoCVE-2026-640079.8In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxyCVE-2026-640087.8In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in create_bo rocket_ioctCVE-2026-640097.8In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB writeCVE-2026-64014.3The Bottom Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.1.7. This is due to mi
CVE-2026-63999: Medium severity, CVSS 5.5 | Vulnix