In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel-livepatch-6.12.25-32.101Upgrade kernel6.12Upgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade python3-perf6.12Upgrade kernel-develUpgrade kernel-libbpf-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade bpftool-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-aarch64 | Jun 24, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade kernel-azure-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-qaUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-default-vdsoUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade kernel-obs-buildUpgrade kernel-64kb-develUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-source-azureUpgrade reiserfs-kmp-default | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-gcpUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-awsUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-22-generic-64k | Jun 26, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub