CVE-2026-63995

Analyzed Analyzed - Analysis Complete

ethtool CMIS Firmware Update Memory Corruption

Publication date: 2026-07-19

Last updated on: 2026-10-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-07

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63995

EUVD

EUVD-2026-45568

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.93 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ethtool CMIS firmware update code. It involves a buffer overflow where the start_cmd_payload_size value from a module's firmware management reply is used directly in a memcpy operation without validation. The destination buffer is only 112 bytes, but a malicious module or corrupted response could provide a larger size, causing an out-of-bounds write in cmis_fw_update_start_download().

Detection Guidance

This vulnerability is specific to the Linux kernel's ethtool CMIS firmware update functionality. Detection requires checking kernel logs for related errors or examining network interface firmware update processes. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker with access to a malicious network module to trigger a buffer overflow, potentially leading to system crashes, data corruption, or privilege escalation. It may also enable arbitrary code execution if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a buffer overflow in the Linux kernel's ethtool CMIS firmware update code. However, if exploited, it could lead to system instability or unauthorized code execution, potentially compromising data integrity or confidentiality, which are key concerns under GDPR and HIPAA.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Avoid performing CMIS firmware updates on untrusted or potentially malicious modules. Monitor kernel logs for any out-of-bounds write errors related to ethtool CMIS operations.

Hi! I’m here to help you understand CVE-2026-63995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70