CVE-2026-68440

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: fix heap overflow when reading module EEPROM

txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-aligned length therefore causes an out-of-bounds write. Copy only the remaining bytes on the final dword instead.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 9b97b6b5635b3de18debd07a3adcf25198ec8299, < febcced6958158e7e90a55a8567b3f5c3639c0b9; >= 9b97b6b5635b3de18debd07a3adcf25198ec8299, < 6a905a71fd43ce8b45f05044b11491337f232c9d
LinuxLinux6.19

References

Timeline

Published
Aug 12, 2026
Last modified
Aug 17, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-68441In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC fCVE-2026-684427.8In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When bCVE-2026-68443In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop CVE-2026-68444In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffCVE-2026-684457.8In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_objCVE-2026-684467.8In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comesCVE-2026-684477.1In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRICVE-2026-68448In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds ComCVE-2026-68449In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanniCVE-2026-68455.0A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of SerCVE-2026-68450In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_roCVE-2026-684517.8In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2
CVE-2026-68440: High severity, CVSS 7.8 | Vulnix