The Linux kernel's ethtool CMIS firmware update code reads the start_cmd_payload_size from a module's firmware management features CDB reply and uses it directly as the byte count in a memcpy operation. Since the destination buffer is limited to 112 bytes, an unchecked larger size can cause an out-of-bounds write in the cmis_fw_update_start_download() function. The fix involves validating the start_cmd_payload_size to prevent this condition and erroring out if the size is too large.

A malicious or corrupted module can trigger an out-of-bounds write in kernel memory during the CMIS firmware update process. This could potentially lead to memory corruption, instability, or escalation of privileges within the kernel context. However, no known exploits are reported in the wild.

A fix has been implemented to validate the start_cmd_payload_size and prevent out-of-bounds writes by erroring out on invalid sizes. Users should apply the official Linux kernel updates that include this patch once available. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation.