LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37791: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte. Using the pointer size instead can cause stack corruption: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace: <TASK> panic+0x339/0x360 ? ethtool_cmis_wait_for_cond+0xf4/0x100 ? __pfx_status_success+0x10/0x10 ? __pfx_status_fail+0x10/0x10 __stack_chk_fail+0x10/0x10 ethtool_cmis_wait_for_cond+0xf4/0x100 ethtool_cmis_cdb_execute_cmd+0x1fc/0x330 ? __pfx_status_fail+0x10/0x10 cmis_cdb_module_features_get+0x6d/0xd0 ethtool_cmis_cdb_init+0x8a/0xd0 ethtool_cmis_fw_update+0x46/0x1d0 module_flash_fw_work+0x17/0xa0 process_one_work+0x179/0x390 worker_thread+0x239/0x340 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel error can overwrite stack memory while handling certain CMIS transceiver module operations, causing a kernel panic and potentially affecting confidentiality, integrity, and availability. The documented failure occurred during module firmware-update processing. Exploitation requires local access according to the supplied CVSS vector; this is not described as a remotely exploitable flaw.

Executive priority

Prioritize accelerated patching for servers and network appliances that manage CMIS transceivers or perform module firmware updates. Other systems should receive the corrected kernel through normal high-severity maintenance. The local-access requirement reduces immediate internet-facing risk, but a kernel panic on infrastructure hardware can still create material service disruption.

Technical view

ethtool_cmis_module_poll() received rpl as a pointer but used the pointer size instead of the one-byte object size. The oversized operation can corrupt the kernel stack during CMIS CDB polling. Referenced stable-kernel commits change the size calculation to sizeof(*rpl). The supplied rating is CVSS 3.1 7.8: local, low complexity, low privileges, no user interaction.

Likely exposure

Exposure is limited to Linux systems containing the vulnerable ethtool CMIS CDB code and exercising the affected module-polling path, particularly during supported transceiver firmware operations. The supplied metadata identifies 6.11, 6.12.25, 6.14.4, and 6.15, but exact affected ranges and distribution backports should be confirmed with each kernel vendor.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. It documents a reproducible kernel panic and stack corruption. Although the CVSS assessment assigns high confidentiality, integrity, and availability impacts, the available evidence demonstrates crashing rather than a confirmed privilege-escalation technique.

Researcher notes

The demonstrated primitive is an incorrect response-buffer length: pointer size is used where one byte is expected. Stack-protector detection produced the reported panic. The bundle does not establish reliable code execution, exploitation in the wild, or every affected version boundary. Researchers should compare vendor source trees against the three stable fixes and account for backports.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable referenced stable fix.
  • Confirm distribution backports rather than relying only on the displayed kernel version.
  • Until patched, avoid affected CMIS module firmware operations where operationally practical.
  • Restrict local system access and administrative hardware-management capabilities.

Validation and detection

  • Inventory kernel builds on systems managing CMIS-capable transceiver modules.
  • Check whether each build contains an applicable referenced fixing commit or vendor backport.
  • Review kernel logs for stack-protector failures involving ethtool_cmis_wait_for_cond.
  • Verify normal CMIS management after updating without deliberately triggering corruption.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37791 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37791Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa39c84d796254e6b1662ca0c46dbc313379e9291, a39c84d796254e6b1662ca0c46dbc313379e9291, a39c84d796254e6b1662ca0c46dbc313379e9291unaffected
LinuxLinux6.11, 0, 6.12.25, 6.14.4, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.