Look up another CVE ยท open CVE-2026-63996 in the interactive tracker
CVE-2026-63996
ethtool: cmis: require exact CDB reply length
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/ethtool. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-63996 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Malicious SFP module could respond with rpl_len longer than what cmis_cdb_process_reply() expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be buggy and/or the reads may occasionally get corrupted, so let's protect the kernel. The existing check protects from short replies. We need to protect from long ones, too. All callers that pass a non-zero rpl_exp_len cast the reply payload to a fixed-layout struct and read fields at fixed offsets, with no version negotiation or short-reply handling: - cmis_cdb_validate_password() - cmis_cdb_module_features_get() - cmis_fw_update_fw_mng_features_get() so let's assume that responses longer than expected do not have to be handled gracefully here. Add a warning message to make the debug easier in case my understanding is wrong... Note that page_data->length (argument of kmalloc) comes from last arg to ethtool_cmis_page_init() which is rpl_exp_len. Note2 that AIs also like to point out overflows in args->req.payload itself (which is a fixed-size 120 B buffer, on the stack), but callers should be reading structs defined by the standard, so protecting from requests for more data than max seem like defensive programming.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ethtool/cmis_cdb.c
- What this is
- NETWORKING [ETHTOOL]MAINTAINERS section matched on net/ethtool/
Check it on the machine
grep -w CONFIG_ETHTOOL_NETLINK /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sidy
- ?
- not established - no Makefile entry for the affected file
- y
- built into the kernel image on every flavour - only a patch removes it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_ETHTOOL_NETLINK
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/ethtool
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.11 | 6.12.93 | 2f818cc98fd2 |
| 6.11 | 6.18.35 | 4d42fb88ec61 |
| 6.11 | 7.0.12 | eb5dcd740cd7 |
| 6.11 | 7.1 | 6c3f999a9d13 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable code is reached only via the local ethtool genetlink firmware-flash path (ETHTOOL_MSG_MODULE_FW_FLASH_ACT), not from remote network input; a malicious transceiver supplies the malformed CDB reply once that local ioctl-like operation is invoked.
- AC:LAttack complexity, low
- A malicious CMIS module can reliably set rpl_len up to 255 on CDB replies; no race or uncontrollable memory layout is required, and an attacker with CAP_NET_ADMIN can bring the netdev down and initiate flashing deterministically.
- PR:LPrivileges required, low
- Triggering module firmware flash requires CAP_NET_ADMIN, which is enforced via GENL_UNS_ADMIN_PERM/netlink_ns_capable and is obtainable by unprivileged users inside a user namespace (unshare -Urn), not only by init-namespace root.
- UI:NUser interaction, none
- Exploitation does not require a separate victim user action beyond the attacker (or compromised local process with CAP_NET_ADMIN) issuing the ethtool module firmware-flash command; no interactive victim steps are needed.
- S:UScope, unchanged
- Impact is kernel stack corruption and potential privilege escalation or denial of service within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary crossing.
- C:HConfidentiality impact, high
- The out-of-bounds stack write corrupts adjacent kernel stack memory and can be leveraged for arbitrary kernel memory disclosure; related CMIS ethtool bugs in the same path have already caused demonstrable stack corruption.
- I:HIntegrity impact, high
- memcpy() can write up to 135 bytes past the 120-byte payload buffer on the kernel stack, enabling control-data corruption and potential arbitrary kernel code execution, not merely a bounded modification.
- A:HAvailability impact, high
- Stack corruption in this CMIS firmware-flash workqueue path can trigger kernel oops/panic (as seen in the related CVE-2025-37791 stack-protector failure in the same call chain) or hang the affected system.