CVE-2026-68440
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel's txgbe network driver, txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which is allocated with exactly 'length' bytes. A non-4-aligned length causes an out-of-bounds write (heap overflow).
Risk Assessment
The vulnerability can lead to heap memory corruption, potentially allowing a local attacker to escalate privileges or crash the system.
Recommendation
Apply the kernel patch that copies only the remaining bytes on the final dword to avoid out-of-bounds write.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-aligned length therefore causes an out-of-bounds write. Copy only the remaining bytes on the final dword instead.