In the Linux kernel, the following vulnerability has been resolved:
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.12Upgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel6.12-modules-extraUpgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade perf6.12-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-debuginfoUpgrade kernel-tools-develUpgrade python3-perf6.12Upgrade kernel-toolsUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel-livepatch-6.12.25-32.101 | Jun 24, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-source-azureUpgrade kernel-azureUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-azure-develUpgrade kernel-docsUpgrade kernel-devel-azureUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qa | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-aws-64kUpgrade linux-image-realtimeUpgrade linux-image-oracleUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-genericUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-awsUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-aws-64k | Jun 26, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub