{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63995", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.026Z", "datePublished": "2026-07-19T14:56:14.580Z", "dateUpdated": "2026-08-05T12:37:59.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:59.454Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis: validate start_cmd_payload_size from module\n\nThe CMIS firmware update code reads start_cmd_payload_size from\nthe module's FW Management Features CDB reply and uses it directly\nas the byte count for memcpy. The destination buffer is 112 bytes\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\nmodule (or corrupted response) can cause a OOB write later on in\ncmis_fw_update_start_download().\n\nLet's error out. If modules that expect longer LPL writes actually\nexist we should revisit.\n\nstruct cmis_cdb_start_fw_download_pl's definition has to move,\nno change there."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the ethtool genetlink MODULE_FW_FLASH_ACT handler, not from remote network packet processing. Triggering the bug requires a local privileged process to initiate CMIS firmware flashing on a netdev.\nAC:L - An attacker with CAP_NET_ADMIN who inserts or controls a malicious CMIS module can reliably trigger the overflow by starting a firmware flash while the interface is down. No race or uncontrollable memory-layout conditions are required beyond attacker-controlled module metadata and firmware image content.\nPR:L - The MODULE_FW_FLASH_ACT operation requires CAP_NET_ADMIN enforced via GENL_UNS_ADMIN_PERM with netnsok enabled, which is obtainable by unprivileged users through user namespaces (unshare -Urn). Real init-namespace root is not strictly required.\nUI:N - Exploitation does not depend on a separate victim performing an action; the same privileged attacker who initiates the ethtool firmware-flash command controls the trigger. No end-user interaction beyond the attacker's own administrative operation is needed.\nS:U - The stack buffer overflow corrupts kernel memory within the same kernel security authority. Impact is kernel memory corruption and potential privilege escalation, not a cross-boundary escape such as VM-to-host or IOMMU bypass.\nC:H - The unchecked memcpy performs an out-of-bounds stack write of up to 143 bytes past a 112-byte vendor_data buffer with attacker-controlled firmware content. Stack corruption adjacent to other locals (including ethtool_cmis_cdb_cmd_args) can be leveraged for arbitrary kernel memory read primitives.\nI:H - The out-of-bounds write corrupts the kernel stack with fully attacker-controlled data from the firmware image, enabling control of adjacent structures and potential control-flow hijacking or arbitrary kernel write primitives.\nA:H - Stack corruption in kernel context during firmware update can cause immediate kernel oops or panic. Even without full exploitation, the memory corruption reliably threatens system availability on affected datacenter and cloud NIC deployments using CMIS pluggable optics."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/cmis_fw_update.c"], "versions": [{"version": "c4f78134d45c9619339c96b4bea380b1d0699788", "lessThan": "63112b4515469d00008452d9cfe3fb3bf1aa2df3", "status": "affected", "versionType": "git"}, {"version": "c4f78134d45c9619339c96b4bea380b1d0699788", "lessThan": "0696709e951be54c699664adf546d16e28974d53", "status": "affected", "versionType": "git"}, {"version": "c4f78134d45c9619339c96b4bea380b1d0699788", "lessThan": "a46340da00385be7fb16c62425ebc20006f2d5d8", "status": "affected", "versionType": "git"}, {"version": "c4f78134d45c9619339c96b4bea380b1d0699788", "lessThan": "12c2496a71f82f63617971ca9b730dffa05cf58b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ethtool/cmis_fw_update.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3"}, {"url": "https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53"}, {"url": "https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8"}, {"url": "https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b"}], "title": "ethtool: cmis: validate start_cmd_payload_size from module", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ethtool/cmis_fw_update.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "63112b4515469d00008452d9cfe3fb3bf1aa2df3", "status": "affected", "version": "c4f78134d45c9619339c96b4bea380b1d0699788", "versionType": "git"}, {"lessThan": "0696709e951be54c699664adf546d16e28974d53", "status": "affected", "version": "c4f78134d45c9619339c96b4bea380b1d0699788", "versionType": "git"}, {"lessThan": "a46340da00385be7fb16c62425ebc20006f2d5d8", "status": "affected", "version": "c4f78134d45c9619339c96b4bea380b1d0699788", "versionType": "git"}, {"lessThan": "12c2496a71f82f63617971ca9b730dffa05cf58b", "status": "affected", "version": "c4f78134d45c9619339c96b4bea380b1d0699788", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ethtool/cmis_fw_update.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: cmis: validate start_cmd_payload_size from module\n\nThe CMIS firmware update code reads start_cmd_payload_size from\nthe module's FW Management Features CDB reply and uses it directly\nas the byte count for memcpy. The destination buffer is 112 bytes\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\nmodule (or corrupted response) can cause a OOB write later on in\ncmis_fw_update_start_download().\n\nLet's error out. If modules that expect longer LPL writes actually\nexist we should revisit.\n\nstruct cmis_cdb_start_fw_download_pl's definition has to move,\nno change there."}], "id": "CVE-2026-63995", "lastModified": "2026-07-30T14:51:11.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:39.067", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: ethtool: cmis: validate start_cmd_payload_size from module", "id": "2502378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502378"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nethtool: cmis: validate start_cmd_payload_size from module\nThe CMIS firmware update code reads start_cmd_payload_size from\nthe module's FW Management Features CDB reply and uses it directly\nas the byte count for memcpy. The destination buffer is 112 bytes\n(ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious\nmodule (or corrupted response) can cause a OOB write later on in\ncmis_fw_update_start_download().\nLet's error out. If modules that expect longer LPL writes actually\nexist we should revisit.\nstruct cmis_cdb_start_fw_download_pl's definition has to move,\nno change there.", "A flaw was found in the Linux kernel's ethtool CMIS firmware update code. A malicious module or a corrupted response can provide an oversized payload size during the firmware update process. This can lead to an out-of-bounds write, allowing an attacker to corrupt memory. This memory corruption could potentially enable a local attacker to escalate privileges or execute arbitrary code within the kernel."], "name": "CVE-2026-63995", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63995\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63995\nhttps://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63995-a31c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f78134d45c9619339c96b4bea380b1d0699788,63112b4515469d00008452d9cfe3fb3bf1aa2df3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f78134d45c9619339c96b4bea380b1d0699788,0696709e951be54c699664adf546d16e28974d53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f78134d45c9619339c96b4bea380b1d0699788,a46340da00385be7fb16c62425ebc20006f2d5d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4f78134d45c9619339c96b4bea380b1d0699788,12c2496a71f82f63617971ca9b730dffa05cf58b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T08:30:04.374640+00:00", "updated": "2026-08-04T06:30:05.485377+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}