Executive brief
A vulnerability in the Linux kernel's network tool component (ethtool) could allow a malicious or faulty hardware module to crash the system. When updating firmware on certain network transceivers, the system fails to verify the size of data sent by the hardware, leading to a memory error. This could result in a system crash or potentially allow unauthorized code execution if a compromised hardware device is connected.
Technical details
An out-of-bounds (OOB) write vulnerability exists in net/ethtool/cmis_fw_update.c within the Linux kernel. The CMIS firmware update mechanism reads the 'start_cmd_payload_size' from a module's FW Management Features CDB (Command Data Block) reply and uses it as a length argument for a memcpy operation without validation. Because the destination buffer is fixed at 112 bytes, a malicious or malfunctioning module can provide a larger size value to trigger a heap-based buffer overflow. This occurs specifically during the cmis_fw_update_start_download() process. Patches have been released for various stable branches including 6.12.93, 6.18.35, and 7.0.12.
Affected products
- Linux Linux Kernel 6.11, 6.12.x, 6.18.x, 7.0.x
Timeline
- 2026-05-22: other: Initial patch authored by Jakub Kicinski
- 2026-07-19: disclosed: CVE published and NVD record created