Review reviewHigh

CVE-2026-63996

Linux

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpl_len longer than what cmis_cdb_process_reply() expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be buggy and/or the reads may occasionally get corrupted, so let's protect the kernel. The existing check protects from short replies. We need to protect from long ones, too. All callers that pass a non-zero rpl_exp_len cast the reply payload to a fixed-layout struct and read fields at fixed offsets...

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2026.07.20

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= a39c84d796254e6b1662ca0c46dbc313379e9291 < 2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3, >= a39c84d796254e6b1662ca0c46dbc313379e9291 < 4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1, >= a39c84d796254e6b1662ca0c46dbc313379e9291 < eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3, >= a39c84d796254e6b1662ca0c46dbc313379e9291 < 6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1, >= 6.11
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available