A malformed reply from a CMIS‑compliant SFP module can cause the Linux kernel’s ethtool cmis subsystem to write beyond the bounds of a fixed‑size payload buffer. The code assumes the reply length exactly matches the expected value and casts the payload to a predefined struct, so an overlong reply results in an out‑of‑bounds write and possible corruption of kernel memory. This flaw is a buffer overflow (CWE‑787) and could enable privilege escalation or denial‑of‑service if an attacker can control the reply.

All Linux kernel implementations that include the ethtool cmis code before the patch are vulnerable; this applies to the Linux kernel as published by all vendors under the Linux:Linux CID. No specific kernel version range is listed, so any release prior to the security commit referenced in the provided git logs is affected.

The CVSS score of 7.8 signifies high severity, but the EPSS score is reported as < 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. The likely attack vector involves a malicious or buggy SFP module that returns a reply longer than the kernel expects, and it requires physical or firmware access to the network hardware, making widespread remote exploitation unlikely in most environments.