The CMIS firmware update code in the Linux kernel reads a size field, start_cmd_payload_size, from a module’s firmware management reply and uses that value directly as the byte count in a memcpy. The destination buffer is only 112 bytes long, so a malicious module or a corrupted response can cause an out‑of‑bounds write during cmis_fw_update_start_download(). This results in kernel memory corruption, potentially leading to a system crash or privilege escalation. The vulnerability carries a CVSS score of 7.8, indicating a high severity and a substantial impact on system integrity.

Any Linux kernel that includes the ethtool CMIS firmware update feature and does not yet incorporate the patch is susceptible. The exact affected kernel versions are not listed, but the CVE applies to all kernels containing this unpatched code path whenever the CMIS interface is active.

Although the EPSS score is below 1% and the issue is not listed in CISA KEV, the vulnerability can be exploited by an attacker who can load or influence a kernel module, which typically requires local or privileged access. An attacker may cause a kernel crash or elevate privileges if additional conditions are met. The CVSS score of 7.8 reflects the significant damage that could result once the vulnerability is triggered.