CVE-2026-63995: Linux, грешка в паметта

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.

Засегнати продукти

• Linux Linux: c4f78134d45c9619339c96b4bea380b1d0699788 преди 63112b4515469d00008452d9cfe3fb3bf1aa2df3; c4f78134d45c9619339c96b4bea380b1d0699788 преди 0696709e951be54c699664adf546d16e28974d53; c4f78134d45c9619339c96b4bea380b1d0699788 преди a46340da00385be7fb16c62425ebc20006f2d5d8; c4f78134d45c9619339c96b4bea380b1d0699788 преди 12c2496a71f82f63617971ca9b730dffa05cf58b
• Linux Linux: 6.11; преди 6.11; 6.12.93 до 6.12.*; 6.18.35 до 6.18.*; 7.0.12 до 7.0.*; 7.1 до *

Вид слабост

• CWE-787 Out-of-bounds Write

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-63995
• https://nvd.nist.gov/vuln/detail/CVE-2026-63995
• https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3
• https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53
• https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8
• https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b