Out-of-Bounds Write Vulnerability in Linux Kernel Affecting Ethernet Device Drivers

CVE-2026-63996

What is CVE-2026-63996?

A vulnerability exists in the Linux kernel's handling of responses from ethernet device drivers. The issue arises when a malicious or buggy SFP module returns a response length longer than expected, resulting in potential out-of-bounds writes. This vulnerability can lead to instability in system operations and may allow exploitation via specially crafted network responses. To mitigate this risk, the kernel has added safeguards against excessive response lengths, enhancing the overall security posture of the kernel.

References