CVE-2026-64526: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64526 is a resource cleanup flaw in the Linux kernel's ethtool tsconfig subsystem, where tsconfig_prepare_data() calls ethnl_ops_begin() but fails to call the corresponding ethnl_ops_complete() before returning on error, leading to a resource leak. The vulnerability was published on July 25, 2026, and affects Linux kernel versions starting from commit 6e9e2eed4f39d52edf5fd006409d211facf49f6b through kernel 6.14 and later branches up to the fixed releases. Patched versions include kernel 6.18.35, 7.0.12, and 7.1. No official CVSS score has been assigned; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a missing cleanup call in the Linux kernel's ethtool timestamp configuration (tsconfig) subsystem. Specifically, tsconfig_prepare_data() invokes ethnl_ops_begin() to acquire a resource lock or reference, but on certain error paths, it returns without calling the paired ethnl_ops_complete(), violating the acquire/release contract and causing a resource leak (broadly classifiable as CWE-459: Incomplete Cleanup). Exploitation requires local access with network interface configuration privileges; an attacker or unprivileged local user with sufficient rights triggers the flaw by invoking ethtool tsconfig operations that result in an error condition. No CWE has been formally assigned, and no public proof-of-concept exploit code is known (GitHub Advisory, Feedly).

Repeated triggering of the faulty error path can cause kernel resource exhaustion over time, potentially degrading system performance or causing a kernel crash, resulting in a local denial of service. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. The scope is confined to the affected host, with no known potential for lateral movement or data exfiltration (Feedly, GitHub Advisory).

Apply the Linux kernel patches that resolve the missing ethnl_ops_complete() call in tsconfig_prepare_data(). Fixed commits are available for multiple stable branches: d02342d9bb4f (one branch), d53fe379d1f9 (another branch), and 6386bd772de6 (a third branch). Fixed stable releases are kernel 6.18.35, 7.0.12, and 7.1. As a workaround on unpatched systems, restrict local user access to ethtool/network interface configuration operations and monitor kernel logs for resource exhaustion indicators (GitHub Advisory, Feedly).