CVE-2026-63995
Received Received - Intake

ethtool CMIS Firmware Update Memory Corruption

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63995
EUVD
EUVD-2026-45568

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's ethtool CMIS firmware update code. It involves a buffer overflow where the start_cmd_payload_size value from a module's firmware management reply is used directly in a memcpy operation without validation. The destination buffer is only 112 bytes, but a malicious module or corrupted response could provide a larger size, causing an out-of-bounds write in cmis_fw_update_start_download().

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool CMIS firmware update functionality. Detection requires checking kernel logs for related errors or examining network interface firmware update processes. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker with access to a malicious network module to trigger a buffer overflow, potentially leading to system crashes, data corruption, or privilege escalation. It may also enable arbitrary code execution if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a buffer overflow in the Linux kernel's ethtool CMIS firmware update code. However, if exploited, it could lead to system instability or unauthorized code execution, potentially compromising data integrity or confidentiality, which are key concerns under GDPR and HIPAA.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Avoid performing CMIS firmware updates on untrusted or potentially malicious modules. Monitor kernel logs for any out-of-bounds write errors related to ethtool CMIS operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63995. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart