🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-63999 is a Linux kernel vulnerability in the ethtool subsystem, specifically within the RSS (Receive Side Scaling) network driver code. A flaw in the get_rxfh error-handling path causes memory leaks of the indirection table and hash key, potentially exposing sensitive data or enabling denial-of-service conditions. This affects Azure infrastructure running Linux-based workloads where the vulnerable kernel component is present.
Security Architect’s Take: Review whether your Azure Linux VMs or AKS node pools are running kernel versions affected by this ethtool RSS flaw and prioritise patching via Azure Update Manager or your existing patch management pipeline. As this is a kernel-level issue, container workloads sharing the host kernel are equally exposed, so assess AKS and container-based deployments as a priority.
Original advisory: CVE-2026-63999 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure