Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a malicious or faulty hardware module (SFP) to cause a system crash or potentially execute unauthorized code. This occurs when the system interacts with a pluggable network transceiver that sends more data than the system expects during configuration. While exploiting this requires physical access to the hardware or a compromised supply chain, it could lead to a complete loss of system availability or data integrity on affected servers.
Technical details
A vulnerability exists in 'net/ethtool/cmis_cdb.c' within the Linux kernel where 'cmis_cdb_process_reply()' fails to properly validate the length of replies from SFP modules. A malicious or buggy SFP module can return a 'rpl_len' value larger than the expected length ('rpl_exp_len'), leading to an out-of-bounds (OOB) write when the payload is processed. This occurs because the kernel casts the reply to fixed-layout structures without verifying that the received data fits within the allocated buffer. The issue has been resolved by enforcing an exact match between the expected and received reply lengths. Patches are available in various stable kernel branches including 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.11, 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Jakub Kicinski
- 2026-06-09: patched: Patches committed to stable branches
- 2026-07-19: advisory: CVE-2026-63996 published