In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perf6.12Upgrade kernel-tools-develUpgrade kernel6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel-develUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade perf6.12 | Jun 24, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-sourceUpgrade kernel-azure-extraUpgrade kernel-symsUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade kernel-default-develUpgrade kernel-source-vanillaUpgrade kernel-default-vdsoUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-source-azureUpgrade kernel-default-livepatch | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-oracleUpgrade linux-image-awsUpgrade linux-image-aws-64kUpgrade linux-image-genericUpgrade linux-image-gcpUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-azureUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-1008-gcp | Jun 26, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub