CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module
In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis: validate startcmdpayloadsize from module
The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOLCMISCDBLPLMAXPLLENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmisfwupdatestartdownload().
Let's error out. If modules that expect longer LPL writes actually exist we should revisit.
struct cmiscdbstartfwdownloadpl's definition has to move, no change there.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate the module-provided start_cmd_payload_size in cmis_fw_update_start_download() before memcpy and error out if it would exceed the 112-byte destination buffer or the permitted ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8 limit.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63995?
CVE-2026-63995 has a risk rating of 50.
What does CVE-2026-63995 affect?
CVE-2026-63995 affects the Linux kernel's ethtool component.
How do I fix CVE-2026-63995?
To mitigate CVE-2026-63995, update your Linux kernel to the latest patched version.
What type of vulnerability is CVE-2026-63995?
CVE-2026-63995 is a memory handling vulnerability that affects firmware management.
When was CVE-2026-63995 published?
CVE-2026-63995 was published on July 19, 2026.