CVE-2026-63996: ethtool: cmis: require exact CDB reply length

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ethtool: cmis: require exact CDB reply length

Malicious SFP module could respond with rpl_len longer than
what cmis_cdb_process_reply() expected, leading to OOB writes.
Malicious HW is a bit theoretical but some modules may just
be buggy and/or the reads may occasionally get corrupted,
so let's protect the kernel.

The existing check protects from short replies. We need to
protect from long ones, too. All callers that pass a non-zero
rpl_exp_len cast the reply payload to a fixed-layout struct
and read fields at fixed offsets, with no version negotiation
or short-reply handling:

  - cmis_cdb_validate_password()
  - cmis_cdb_module_features_get()
  - cmis_fw_update_fw_mng_features_get()

so let's assume that responses longer than expected do not
have to be handled gracefully here. Add a warning message
to make the debug easier in case my understanding is wrong...

Note that page_data->length (argument of kmalloc) comes from
last arg to ethtool_cmis_page_init() which is rpl_exp_len.

Note2 that AIs also like to point out overflows in args->req.payload
itself (which is a fixed-size 120 B buffer, on the stack),
but callers should be reading structs defined by the standard,
so protecting from requests for more data than max seem like
defensive programming.

The Linux kernel CVE team has assigned CVE-2026-63996 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 6.12.93 with commit 2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3
	Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 6.18.35 with commit 4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1
	Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 7.0.12 with commit eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3
	Issue introduced in 6.11 with commit a39c84d796254e6b1662ca0c46dbc313379e9291 and fixed in 7.1 with commit 6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-63996
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ethtool/cmis_cdb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3
	https://git.kernel.org/stable/c/4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1
	https://git.kernel.org/stable/c/eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3
	https://git.kernel.org/stable/c/6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1