CVE-2026-63996

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ethtool CMIS component where the kernel does not properly validate the length of the Common Management Interface Specification (CMIS) Capability Data Block (CDB) reply. A malicious or buggy SFP module could provide a reply length (rpl len) longer than expected by the cmis cdb process reply() function, potentially leading to out-of-bounds writes. This affects callers that cast the reply payload to fixed-layout structures, specifically within the cmis cdb validate password(), cmis cdb module features get(), and cmis fw update fw mng features get() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.