PT-2026-61312 · Linux · Linux Kernel

CVE-2026-63995 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write can occur in the CMIS firmware update code within the ethtool component. The issue arises because the system reads the start cmd payload size from the module's FW Management Features CDB reply and uses it as the byte count for a memcpy() operation without proper validation. Since the destination buffer is limited to 112 bytes, a malicious or corrupted module response can trigger a memory write beyond the buffer boundaries in the cmis fw update start download() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63995

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63995 · Security Note
• https://twitter.com/CVEnew/status/2078861453356900620 · Twitter Post
• https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8 · Note
• https://twitter.com/infoflowcloud/status/2078862715188105456 · Twitter Post
• https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3 · Note
• https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b · Note
• https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53 · Note