CVE-2026-63995
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
19/07/2026
Última modificación:
20/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ethtool: cmis: validate start_cmd_payload_size from module<br />
<br />
The CMIS firmware update code reads start_cmd_payload_size from<br />
the module&#39;s FW Management Features CDB reply and uses it directly<br />
as the byte count for memcpy. The destination buffer is 112 bytes<br />
(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious<br />
module (or corrupted response) can cause a OOB write later on in<br />
cmis_fw_update_start_download().<br />
<br />
Let&#39;s error out. If modules that expect longer LPL writes actually<br />
exist we should revisit.<br />
<br />
struct cmis_cdb_start_fw_download_pl&#39;s definition has to move,<br />
no change there.
Impacto
Puntuación base 3.x
7.80
Gravedad 3.x
ALTA