ALSA-2026:93911 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ethtool: cmis: require exact CDB reply length CVE-2026-63996 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

PT-2026-61313

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethtool CMIS component where the kernel does not properly validate the length of the Common Management Interface Specification CMIS Capability Data Block CDB reply...