CVE-2026-63996

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel ethtool CMIS Module

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl_len longer than what cmis_cdb_process_reply() expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be buggy and/or the reads may occasionally get corrupted, so let's protect the kernel. The existing check protects from short replies. We need to protect from long ones, too. All callers that pass a non-zero rpl_exp_len cast the reply payload to a fixed-layout struct and read fields at fixed offsets, with no version negotiation or short-reply handling: - cmis_cdb_validate_password() - cmis_cdb_module_features_get() - cmis_fw_update_fw_mng_features_get() so let's assume that responses longer than expected do not have to be handled gracefully here. Add a warning message to make the debug easier in case my understanding is wrong... Note that page_data->length (argument of kmalloc) comes from last arg to ethtool_cmis_page_init() which is rpl_exp_len. Note2 that AIs also like to point out overflows in args->req.payload itself (which is a fixed-size 120 B buffer, on the stack), but callers should be reading structs defined by the standard, so protecting from requests for more data than max seem like defensive programming.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63996

EUVD

EUVD-2026-45569

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.11 (inc) to 6.12.93 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ethtool CMIS module where malicious SFP modules or corrupted reads could send responses longer than expected. This leads to out-of-bounds (OOB) memory writes because the kernel does not validate the length of these responses properly.

Detection Guidance

This vulnerability involves potential out-of-bounds writes due to malformed responses from SFP modules. Detection requires checking kernel logs for ethtool-related errors or warnings, particularly those involving CMIS module interactions. Monitor logs with commands like 'dmesg | grep ethtool' or 'journalctl -k | grep ethtool' to identify unusual activity.

Impact Analysis

This vulnerability could allow attackers to corrupt kernel memory by exploiting malformed or malicious SFP module responses. This might lead to system crashes, privilege escalation, or other unintended behavior depending on the kernel's memory layout and protections.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux ethtool subsystem. Compliance impacts would only occur if this vulnerability were exploited to gain unauthorized access to sensitive data or disrupt systems handling regulated data.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable or replace any suspicious SFP modules that may send malformed responses. Monitor network traffic for unusual module behavior and update ethtool to the patched version if available.

Hi! I’m here to help you understand CVE-2026-63996. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70