CVE-2026-63995 (GCVE-0-2026-63995)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.
References
Impacted products
Vendor Product Version
Linux Linux Version: c4f78134d45c9619339c96b4bea380b1d0699788
Version: c4f78134d45c9619339c96b4bea380b1d0699788
Version: c4f78134d45c9619339c96b4bea380b1d0699788
Version: c4f78134d45c9619339c96b4bea380b1d0699788
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63995",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:34:53.737035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:18:01.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cmis_fw_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63112b4515469d00008452d9cfe3fb3bf1aa2df3",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "0696709e951be54c699664adf546d16e28974d53",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "a46340da00385be7fb16c62425ebc20006f2d5d8",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            },
            {
              "lessThan": "12c2496a71f82f63617971ca9b730dffa05cf58b",
              "status": "affected",
              "version": "c4f78134d45c9619339c96b4bea380b1d0699788",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ethtool/cmis_fw_update.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis: validate start_cmd_payload_size from module\n\nThe CMIS firmware update code reads start_cmd_payload_size from\nthe module\u0027s FW Management Features CDB reply and uses it directly\nas the byte count for memcpy. The destination buffer is 112 bytes\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\nmodule (or corrupted response) can cause a OOB write later on in\ncmis_fw_update_start_download().\n\nLet\u0027s error out. If modules that expect longer LPL writes actually\nexist we should revisit.\n\nstruct cmis_cdb_start_fw_download_pl\u0027s definition has to move,\nno change there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the ethtool genetlink MODULE_FW_FLASH_ACT handler, not from remote network packet processing. Triggering the bug requires a local privileged process to initiate CMIS firmware flashing on a netdev.\nAC:L - An attacker with CAP_NET_ADMIN who inserts or controls a malicious CMIS module can reliably trigger the overflow by starting a firmware flash while the interface is down. No race or uncontrollable memory-layout conditions are required beyond attacker-controlled module metadata and firmware image content.\nPR:L - The MODULE_FW_FLASH_ACT operation requires CAP_NET_ADMIN enforced via GENL_UNS_ADMIN_PERM with netnsok enabled, which is obtainable by unprivileged users through user namespaces (unshare -Urn). Real init-namespace root is not strictly required.\nUI:N - Exploitation does not depend on a separate victim performing an action; the same privileged attacker who initiates the ethtool firmware-flash command controls the trigger. No end-user interaction beyond the attacker\u0027s own administrative operation is needed.\nS:U - The stack buffer overflow corrupts kernel memory within the same kernel security authority. Impact is kernel memory corruption and potential privilege escalation, not a cross-boundary escape such as VM-to-host or IOMMU bypass.\nC:H - The unchecked memcpy performs an out-of-bounds stack write of up to 143 bytes past a 112-byte vendor_data buffer with attacker-controlled firmware content. Stack corruption adjacent to other locals (including ethtool_cmis_cdb_cmd_args) can be leveraged for arbitrary kernel memory read primitives.\nI:H - The out-of-bounds write corrupts the kernel stack with fully attacker-controlled data from the firmware image, enabling control of adjacent structures and potential control-flow hijacking or arbitrary kernel write primitives.\nA:H - Stack corruption in kernel context during firmware update can cause immediate kernel oops or panic. Even without full exploitation, the memory corruption reliably threatens system availability on affected datacenter and cloud NIC deployments using CMIS pluggable optics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:59.454Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53"
        },
        {
          "url": "https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b"
        }
      ],
      "title": "ethtool: cmis: validate start_cmd_payload_size from module",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63995",
    "datePublished": "2026-07-19T14:56:14.580Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-10-19T20:18:01.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63995\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:34:53.737035Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:34:54.293Z\"}}], \"cna\": {\"title\": \"ethtool: cmis: validate start_cmd_payload_size from module\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through the ethtool genetlink MODULE_FW_FLASH_ACT handler, not from remote network packet processing. Triggering the bug requires a local privileged process to initiate CMIS firmware flashing on a netdev.\\nAC:L - An attacker with CAP_NET_ADMIN who inserts or controls a malicious CMIS module can reliably trigger the overflow by starting a firmware flash while the interface is down. No race or uncontrollable memory-layout conditions are required beyond attacker-controlled module metadata and firmware image content.\\nPR:L - The MODULE_FW_FLASH_ACT operation requires CAP_NET_ADMIN enforced via GENL_UNS_ADMIN_PERM with netnsok enabled, which is obtainable by unprivileged users through user namespaces (unshare -Urn). Real init-namespace root is not strictly required.\\nUI:N - Exploitation does not depend on a separate victim performing an action; the same privileged attacker who initiates the ethtool firmware-flash command controls the trigger. No end-user interaction beyond the attacker\u0027s own administrative operation is needed.\\nS:U - The stack buffer overflow corrupts kernel memory within the same kernel security authority. Impact is kernel memory corruption and potential privilege escalation, not a cross-boundary escape such as VM-to-host or IOMMU bypass.\\nC:H - The unchecked memcpy performs an out-of-bounds stack write of up to 143 bytes past a 112-byte vendor_data buffer with attacker-controlled firmware content. Stack corruption adjacent to other locals (including ethtool_cmis_cdb_cmd_args) can be leveraged for arbitrary kernel memory read primitives.\\nI:H - The out-of-bounds write corrupts the kernel stack with fully attacker-controlled data from the firmware image, enabling control of adjacent structures and potential control-flow hijacking or arbitrary kernel write primitives.\\nA:H - Stack corruption in kernel context during firmware update can cause immediate kernel oops or panic. Even without full exploitation, the memory corruption reliably threatens system availability on affected datacenter and cloud NIC deployments using CMIS pluggable optics.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c4f78134d45c9619339c96b4bea380b1d0699788\", \"lessThan\": \"63112b4515469d00008452d9cfe3fb3bf1aa2df3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c4f78134d45c9619339c96b4bea380b1d0699788\", \"lessThan\": \"0696709e951be54c699664adf546d16e28974d53\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c4f78134d45c9619339c96b4bea380b1d0699788\", \"lessThan\": \"a46340da00385be7fb16c62425ebc20006f2d5d8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c4f78134d45c9619339c96b4bea380b1d0699788\", \"lessThan\": \"12c2496a71f82f63617971ca9b730dffa05cf58b\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ethtool/cmis_fw_update.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ethtool/cmis_fw_update.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3\"}, {\"url\": \"https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53\"}, {\"url\": \"https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8\"}, {\"url\": \"https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nethtool: cmis: validate start_cmd_payload_size from module\\n\\nThe CMIS firmware update code reads start_cmd_payload_size from\\nthe module\u0027s FW Management Features CDB reply and uses it directly\\nas the byte count for memcpy. The destination buffer is 112 bytes\\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\\nmodule (or corrupted response) can cause a OOB write later on in\\ncmis_fw_update_start_download().\\n\\nLet\u0027s error out. If modules that expect longer LPL writes actually\\nexist we should revisit.\\n\\nstruct cmis_cdb_start_fw_download_pl\u0027s definition has to move,\\nno change there.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.93\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.35\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.12\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:37:59.454Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-63995\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-16T15:42:17.249Z\", \"dateReserved\": \"2026-07-19T07:54:57.026Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-07-19T14:56:14.580Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.