PT-2026-61313 · Linux · Linux Kernel

CVE-2026-63996 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ethtool CMIS component where the kernel does not properly validate the length of the Common Management Interface Specification (CMIS) Capability Data Block (CDB) reply. A malicious or buggy SFP module could provide a reply length (rpl len) longer than expected by the cmis cdb process reply() function, potentially leading to out-of-bounds writes. This affects callers that cast the reply payload to fixed-layout structures, specifically within the cmis cdb validate password(), cmis cdb module features get(), and cmis fw update fw mng features get() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63996

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-63996 · Security Note
• https://git.kernel.org/stable/c/eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3 · Note
• https://git.kernel.org/stable/c/2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3 · Note
• https://git.kernel.org/stable/c/4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1 · Note
• https://twitter.com/CVEnew/status/2078861451372994932 · Twitter Post
• https://twitter.com/infoflowcloud/status/2078862716622471291 · Twitter Post
• https://git.kernel.org/stable/c/6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1 · Note