CVE-2026-63995— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 10
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | c4f78134d45c9619339c96b4bea380b1d0699788< 63112b4515469d00008452d9cfe3fb3bf1aa2df3 | affected |
c4f78134d45c9619339c96b4bea380b1d0699788< 0696709e951be54c699664adf546d16e28974d53 | affected | ||
c4f78134d45c9619339c96b4bea380b1d0699788< a46340da00385be7fb16c62425ebc20006f2d5d8 | affected | ||
c4f78134d45c9619339c96b4bea380b1d0699788< 12c2496a71f82f63617971ca9b730dffa05cf58b | affected | ||
6.11 | affected | ||
< 6.11 | unaffected | ||
6.12.93≤ 6.12.* | unaffected | ||
6.18.35≤ 6.18.* | unaffected | ||
| … +2 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-63995の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
ethtool: cmis: validate start_cmd_payload_size from module
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate start_cmd_payload_size from module The CMIS firmware update code reads start_cmd_payload_size from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOL_CMIS_CDB_LPL_MAX_PL_LENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmis_fw_update_start_download(). Let's error out. If modules that expect longer LPL writes actually exist we should revisit. struct cmis_cdb_start_fw_download_pl's definition has to move, no change there.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于CMIS固件更新代码未验证start_cmd_payload_size，可能导致越界写入。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-63995の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-63995のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-63995 补丁与修复 (4)
Same Patch Batch · Linux · 2026-07-19 · 431 CVEs total
| CVE-2026-63795 | 10.0 CRITICAL | 9p: avoid putting oldfid in p9_client_walk() error path |
| CVE-2026-63984 | 9.8 CRITICAL | ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() |
| CVE-2026-64000 | 9.8 CRITICAL | net: hsr: fix potential OOB access in supervision frame handling |
| CVE-2026-64150 | 9.8 CRITICAL | netfilter: nft_inner: release local_lock before re-enabling softirqs |
| CVE-2026-63922 | 9.8 CRITICAL | ipv6: exthdrs: refresh nh after handling HAO option |
| CVE-2026-63924 | 9.8 CRITICAL | ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() |
| CVE-2026-64046 | 9.8 CRITICAL | net: tls: prevent chain-after-chain in plain text SG |
| CVE-2026-64047 | 9.8 CRITICAL | net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring |
| CVE-2026-63994 | 9.8 CRITICAL | tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() |
| CVE-2026-64142 | 9.8 CRITICAL | ksmbd: close durable scavenger races against m_fp_list lookups |
| CVE-2026-63993 | 9.8 CRITICAL | vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() |
| CVE-2026-64055 | 9.8 CRITICAL | net: ethernet: cortina: Carry over frag counter |
| CVE-2026-53398 | 9.8 CRITICAL | NFSD: Fix SECINFO_NO_NAME decode error cleanup |
| CVE-2026-64132 | 9.8 CRITICAL | ipv6: ioam: refresh hdr pointer before ioam6_event() |
| CVE-2026-53399 | 9.8 CRITICAL | nfsd: release layout stid on setlease failure |
| CVE-2026-64125 | 9.8 CRITICAL | net: bcmgenet: keep RBUF EEE/PM disabled |
| CVE-2026-64056 | 9.8 CRITICAL | net: ethernet: cortina: Make RX SKB per-port |
| CVE-2026-64069 | 9.8 CRITICAL | netfs: Fix cancellation of a DIO and single read subrequests |
| CVE-2026-63857 | 9.8 CRITICAL | net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() |
| CVE-2026-63978 | 9.8 CRITICAL | net/handshake: Drain pending requests at net namespace exit |
Showing 20 of 431 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-64206
Bluetooth: L2CAP: cancel pending_rx_work before taking conn- - CVE-2026-64207
net/sched: dualpi2: fix GSO backlog accounting - CVE-2026-64205
i2c: i801: fix hardware state machine corruption in error pa - CVE-2026-64192
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM i - CVE-2026-64191
i2c: stub: Reject I2C block transfers with invalid length
同じベンダー: Linux
- CVE-2026-64206
Bluetooth: L2CAP: cancel pending_rx_work before taking conn- - CVE-2026-64207
net/sched: dualpi2: fix GSO backlog accounting - CVE-2026-64205
i2c: i801: fix hardware state machine corruption in error pa - CVE-2026-64192
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM i - CVE-2026-64191
i2c: stub: Reject I2C block transfers with invalid length
V. CVE-2026-63995へのコメント
まだコメントはありません