CVE-2026-63995

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached only through the ethtool genetlink MODULE_FW_FLASH_ACT handler, not from remote network packet processing. Triggering the bug requires a local privileged process to initiate CMIS firmware flashing on a netdev.

AC:LAttack complexity, low

An attacker with CAP_NET_ADMIN who inserts or controls a malicious CMIS module can reliably trigger the overflow by starting a firmware flash while the interface is down. No race or uncontrollable memory-layout conditions are required beyond attacker-controlled module metadata and firmware image content.

PR:LPrivileges required, low

The MODULE_FW_FLASH_ACT operation requires CAP_NET_ADMIN enforced via GENL_UNS_ADMIN_PERM with netnsok enabled, which is obtainable by unprivileged users through user namespaces (unshare -Urn). Real init-namespace root is not strictly required.

UI:NUser interaction, none

Exploitation does not depend on a separate victim performing an action; the same privileged attacker who initiates the ethtool firmware-flash command controls the trigger. No end-user interaction beyond the attacker's own administrative operation is needed.

S:UScope, unchanged

The stack buffer overflow corrupts kernel memory within the same kernel security authority. Impact is kernel memory corruption and potential privilege escalation, not a cross-boundary escape such as VM-to-host or IOMMU bypass.

C:HConfidentiality impact, high

The unchecked memcpy performs an out-of-bounds stack write of up to 143 bytes past a 112-byte vendor_data buffer with attacker-controlled firmware content. Stack corruption adjacent to other locals (including ethtool_cmis_cdb_cmd_args) can be leveraged for arbitrary kernel memory read primitives.

I:HIntegrity impact, high

The out-of-bounds write corrupts the kernel stack with fully attacker-controlled data from the firmware image, enabling control of adjacent structures and potential control-flow hijacking or arbitrary kernel write primitives.

A:HAvailability impact, high

Stack corruption in kernel context during firmware update can cause immediate kernel oops or panic. Even without full exploitation, the memory corruption reliably threatens system availability on affected datacenter and cloud NIC deployments using CMIS pluggable optics.