In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis: validate start_cmd_payload_size from module
The CMIS firmware update code reads start_cmd_payload_size from
the module's FW Management Features CDB reply and uses it directly
as the byte count for memcpy. The destination buffer is 112 bytes
(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious
module (or corrupted response) can cause a OOB write later on in
cmis_fw_update_start_download().
Let's error out. If modules that expect longer LPL writes actually
exist we should revisit.
struct cmis_cdb_start_fw_download_pl's definition has to move,
no change there.
References
Configurations
Configuration 1 (hide)
|
History
07 Oct 2026, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53 - Patch | |
| References | () https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b - Patch | |
| References | () https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3 - Patch | |
| References | () https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8 - Patch | |
| CWE | CWE-787 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-19 21:17
NVD link : CVE-2026-63995
Mitre link : CVE-2026-63995
CVE.ORG link : CVE-2026-63995
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write