CVE-2026-63995 (GCVE-0-2026-63995)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:37
VLAI
Title
ethtool: cmis: validate start_cmd_payload_size from module
Summary
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c4f78134d45c9619339c96b4bea380b1d0699788 , < 63112b4515469d00008452d9cfe3fb3bf1aa2df3 (git)
Affected: c4f78134d45c9619339c96b4bea380b1d0699788 , < 0696709e951be54c699664adf546d16e28974d53 (git)
Affected: c4f78134d45c9619339c96b4bea380b1d0699788 , < a46340da00385be7fb16c62425ebc20006f2d5d8 (git)
Affected: c4f78134d45c9619339c96b4bea380b1d0699788 , < 12c2496a71f82f63617971ca9b730dffa05cf58b (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cmis_fw_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63112b4515469d00008452d9cfe3fb3bf1aa2df3",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "0696709e951be54c699664adf546d16e28974d53",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "a46340da00385be7fb16c62425ebc20006f2d5d8",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "12c2496a71f82f63617971ca9b730dffa05cf58b",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cmis_fw_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis: validate start_cmd_payload_size from module\n\nThe CMIS firmware update code reads start_cmd_payload_size from\nthe module\u0027s FW Management Features CDB reply and uses it directly\nas the byte count for memcpy. The destination buffer is 112 bytes\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\nmodule (or corrupted response) can cause a OOB write later on in\ncmis_fw_update_start_download().\n\nLet\u0027s error out. If modules that expect longer LPL writes actually\nexist we should revisit.\n\nstruct cmis_cdb_start_fw_download_pl\u0027s definition has to move,\nno change there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the ethtool genetlink MODULE_FW_FLASH_ACT handler, not from remote network packet processing. Triggering the bug requires a local privileged process to initiate CMIS firmware flashing on a netdev.\nAC:L - An attacker with CAP_NET_ADMIN who inserts or controls a malicious CMIS module can reliably trigger the overflow by starting a firmware flash while the interface is down. No race or uncontrollable memory-layout conditions are required beyond attacker-controlled module metadata and firmware image content.\nPR:L - The MODULE_FW_FLASH_ACT operation requires CAP_NET_ADMIN enforced via GENL_UNS_ADMIN_PERM with netnsok enabled, which is obtainable by unprivileged users through user namespaces (unshare -Urn). Real init-namespace root is not strictly required.\nUI:N - Exploitation does not depend on a separate victim performing an action; the same privileged attacker who initiates the ethtool firmware-flash command controls the trigger. No end-user interaction beyond the attacker\u0027s own administrative operation is needed.\nS:U - The stack buffer overflow corrupts kernel memory within the same kernel security authority. Impact is kernel memory corruption and potential privilege escalation, not a cross-boundary escape such as VM-to-host or IOMMU bypass.\nC:H - The unchecked memcpy performs an out-of-bounds stack write of up to 143 bytes past a 112-byte vendor_data buffer with attacker-controlled firmware content. Stack corruption adjacent to other locals (including ethtool_cmis_cdb_cmd_args) can be leveraged for arbitrary kernel memory read primitives.\nI:H - The out-of-bounds write corrupts the kernel stack with fully attacker-controlled data from the firmware image, enabling control of adjacent structures and potential control-flow hijacking or arbitrary kernel write primitives.\nA:H - Stack corruption in kernel context during firmware update can cause immediate kernel oops or panic. Even without full exploitation, the memory corruption reliably threatens system availability on affected datacenter and cloud NIC deployments using CMIS pluggable optics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:59.454Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53"
        },
        {
          "url": "https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b"
        }
      ],
      "title": "ethtool: cmis: validate start_cmd_payload_size from module",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63995",
    "datePublished": "2026-07-19T14:56:14.580Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:37:59.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63995",
      "date": "2026-08-10",
      "epss": "0.00129",
      "percentile": "0.02896"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63995\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:39.067\",\"lastModified\":\"2026-07-30T14:51:11.223\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nethtool: cmis: validate start_cmd_payload_size from module\\n\\nThe CMIS firmware update code reads start_cmd_payload_size from\\nthe module\u0027s FW Management Features CDB reply and uses it directly\\nas the byte count for memcpy. The destination buffer is 112 bytes\\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\\nmodule (or corrupted response) can cause a OOB write later on in\\ncmis_fw_update_start_download().\\n\\nLet\u0027s error out. If modules that expect longer LPL writes actually\\nexist we should revisit.\\n\\nstruct cmis_cdb_start_fw_download_pl\u0027s definition has to move,\\nno change there.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ethtool/cmis_fw_update.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c4f78134d45c9619339c96b4bea380b1d0699788\",\"lessThan\":\"63112b4515469d00008452d9cfe3fb3bf1aa2df3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4f78134d45c9619339c96b4bea380b1d0699788\",\"lessThan\":\"0696709e951be54c699664adf546d16e28974d53\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4f78134d45c9619339c96b4bea380b1d0699788\",\"lessThan\":\"a46340da00385be7fb16c62425ebc20006f2d5d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4f78134d45c9619339c96b4bea380b1d0699788\",\"lessThan\":\"12c2496a71f82f63617971ca9b730dffa05cf58b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ethtool/cmis_fw_update.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:06:08+00:00",
      "cve": "CVE-2026-63995",
      "id": "CVE-2026-63995",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ethtool: cmis: validate start_cmd_payload_size from module",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63995.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:10:38Z",
      "cve": "CVE-2026-63995",
      "id": "CVE-2026-63995",
      "initial_release_date": "2026-07-21T13:01:57Z",
      "product_status:known_affected": "84",
      "product_status:known_not_affected": "212",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63995",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63995.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.