CVE-2026-63996
Received Received - Intake

Buffer Overflow in Linux Kernel ethtool CMIS Module

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl_len longer than what cmis_cdb_process_reply() expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be buggy and/or the reads may occasionally get corrupted, so let's protect the kernel. The existing check protects from short replies. We need to protect from long ones, too. All callers that pass a non-zero rpl_exp_len cast the reply payload to a fixed-layout struct and read fields at fixed offsets, with no version negotiation or short-reply handling: - cmis_cdb_validate_password() - cmis_cdb_module_features_get() - cmis_fw_update_fw_mng_features_get() so let's assume that responses longer than expected do not have to be handled gracefully here. Add a warning message to make the debug easier in case my understanding is wrong... Note that page_data->length (argument of kmalloc) comes from last arg to ethtool_cmis_page_init() which is rpl_exp_len. Note2 that AIs also like to point out overflows in args->req.payload itself (which is a fixed-size 120 B buffer, on the stack), but callers should be reading structs defined by the standard, so protecting from requests for more data than max seem like defensive programming.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63996
EUVD
EUVD-2026-45569

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel ethtool *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ethtool CMIS module where malicious SFP modules or corrupted reads could send responses longer than expected. This leads to out-of-bounds (OOB) memory writes because the kernel does not validate the length of these responses properly.

Detection Guidance

This vulnerability involves potential out-of-bounds writes due to malformed responses from SFP modules. Detection requires checking kernel logs for ethtool-related errors or warnings, particularly those involving CMIS module interactions. Monitor logs with commands like 'dmesg | grep ethtool' or 'journalctl -k | grep ethtool' to identify unusual activity.

Impact Analysis

This vulnerability could allow attackers to corrupt kernel memory by exploiting malformed or malicious SFP module responses. This might lead to system crashes, privilege escalation, or other unintended behavior depending on the kernel's memory layout and protections.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux ethtool subsystem. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access to sensitive data or disrupt systems handling regulated data.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable or replace any suspicious SFP modules that may send malformed responses. Monitor network traffic for unusual module behavior and update ethtool to the patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart