CVE-2026-63995

A flaw was found in the Linux kernel's ethtool CMIS firmware update code. A malicious module or a corrupted response can provide an oversized payload size during the firmware update process. This can lead to an out-of-bounds write, allowing an attacker to corrupt memory. This memory corruption could potentially enable a local attacker to escalate privileges or execute arbitrary code within the kernel.

This vulnerability is rated as Moderate impact because triggering the condition requires physical access to install a rogue or damaged optical transceiver as well as privileged execution of an explicit device firmware update. In typical Red Hat Enterprise Linux environments, network transceiver firmware updates are infrequent administrative tasks, and standard network traffic processing does not touch this execution path. Because the flaw cannot be exercised remotely and relies on specialized physical hardware interaction alongside administrator-level invocation, the overall risk to standard deployments is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.