Cloudanix VulnDB

CVE-2026-63995

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel networking tools could let a local user corrupt memory when updating firmware on certain network modules, risking crashes or system takeover.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unvalidated start_cmd_payload_size read from a CMIS module's FW Management Features CDB reply is used directly as the byte count for memcpy into a fixed 112-byte destination buffer (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8), enabling an out-of-bounds write in cmis_fw_update_start_download().

Why it matters to the business

Local memory corruption on Linux systems that use ethtool to perform firmware updates on CMIS-capable modules, which can lead to kernel crashes, denial of service, or local privilege escalation with moderate operational disruption on affected hosts.

How an attack unfolds

An attacker with local access triggers an ethtool CMIS firmware update and supplies a malicious module or intercepts the CDB reply to return an oversized start_cmd_payload_size value; the kernel then performs an unchecked memcpy that overwrites adjacent memory in cmis_fw_update_start_download().

How to fix it

Apply the upstream Linux kernel patch that adds validation of start_cmd_payload_size against the 112-byte buffer limit before any memcpy; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patched ethtool CMIS code contains an explicit bounds check on start_cmd_payload_size and returns an error for values exceeding the destination buffer; test by supplying an oversized value and verifying graceful failure.

Typical attack path

  1. Obtain local user access on a Linux host with ethtool and CMIS hardware
  2. Initiate a CMIS firmware download via ethtool
  3. Return a crafted CDB reply containing an oversized start_cmd_payload_size
  4. Trigger the memcpy in cmis_fw_update_start_download() to cause OOB write

How to detect it

Review kernel logs and dmesg output around ethtool CMIS firmware update attempts for buffer overflow or memory corruption warnings; no reliable post-exploitation artifacts are known.

What your security team should do

  • Patch Linux kernels on all systems that may perform CMIS firmware updates via ethtool
  • Limit unprivileged local access to ethtool commands where feasible
  • Monitor kernel update channels for backports of this validation fix

The record

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.

Affected packages

Ecosystem Package Introduced Fixed