CVE-2025-37791

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()

rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct

size of rpl is sizeof(*rpl) which should be just 1 byte. Using the

pointer size instead can cause stack corruption:

Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100

CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G OE 6.11.0 #24

Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE

Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023

Workqueue: events module_flash_fw_work

Call Trace:

<TASK>

panic+0x339/0x360

? ethtool_cmis_wait_for_cond+0xf4/0x100

? __pfx_status_success+0x10/0x10

? __pfx_status_fail+0x10/0x10

__stack_chk_fail+0x10/0x10

ethtool_cmis_wait_for_cond+0xf4/0x100

ethtool_cmis_cdb_execute_cmd+0x1fc/0x330

? __pfx_status_fail+0x10/0x10

cmis_cdb_module_fe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References