CVE-2026-64526 ethtool: tsconfig: fix missing ethnl_ops_complete()

Not scored Published 25 Jul 2026 Updated 25 Jul 2026

A missing cleanup call in the Linux kernel ethtool timestamping configuration can lead to resource leaks or instability, requiring local access to exploit.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64526?

CVE-2026-64526 is a vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: tsconfig: fix missing ethnl_ops_complete()

tsconfig_prepare_data() calls ethnl_ops_begin(), we need to call ethnl_ops_complete() before returning the error.

Which versions are affected by CVE-2026-64526?

How do I fix CVE-2026-64526?

Apply the vendor's patch.

Is CVE-2026-64526 being exploited?

There is no known exploitation of CVE-2026-64526 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-64526, DEBIAN-CVE-2026-64526, GHSA-hrj4-fjp6-g5x5, ROOT-OS-UBUNTU-2204-CVE-2026-64526, UBUNTU-CVE-2026-64526.