In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel-livepatch-6.12.25-32.101Upgrade kernel-develUpgrade kernel-libbpf-debuginfo | Jun 24, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-64kb-extraUpgrade kernel-default-baseUpgrade kernel-default-livepatchUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-source-azureUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-docs-htmlUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade kernel-macros | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1007-awsUpgrade linux-image-oracle-64kUpgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-aws-64kUpgrade linux-image-realtimeUpgrade linux-image-genericUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-generic-64k | Jun 26, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub