CVE-2026-63995
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/07/2026
Last modified:
20/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ethtool: cmis: validate start_cmd_payload_size from module<br />
<br />
The CMIS firmware update code reads start_cmd_payload_size from<br />
the module&#39;s FW Management Features CDB reply and uses it directly<br />
as the byte count for memcpy. The destination buffer is 112 bytes<br />
(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious<br />
module (or corrupted response) can cause a OOB write later on in<br />
cmis_fw_update_start_download().<br />
<br />
Let&#39;s error out. If modules that expect longer LPL writes actually<br />
exist we should revisit.<br />
<br />
struct cmis_cdb_start_fw_download_pl&#39;s definition has to move,<br />
no change there.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH