{"id":"DEBIAN-CVE-2025-37791","details":"In the Linux kernel, the following vulnerability has been resolved:  ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()  rpl is passed as a pointer to ethtool_cmis_module_poll(), so the correct size of rpl is sizeof(*rpl) which should be just 1 byte.  Using the pointer size instead can cause stack corruption:  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ethtool_cmis_wait_for_cond+0xf4/0x100 CPU: 72 UID: 0 PID: 4440 Comm: kworker/72:2 Kdump: loaded Tainted: G           OE      6.11.0 #24 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/04GWWM, BIOS 1.6.6 09/20/2023 Workqueue: events module_flash_fw_work Call Trace:  \u003cTASK\u003e  panic+0x339/0x360  ? ethtool_cmis_wait_for_cond+0xf4/0x100  ? __pfx_status_success+0x10/0x10  ? __pfx_status_fail+0x10/0x10  __stack_chk_fail+0x10/0x10  ethtool_cmis_wait_for_cond+0xf4/0x100  ethtool_cmis_cdb_execute_cmd+0x1fc/0x330  ? __pfx_status_fail+0x10/0x10  cmis_cdb_module_features_get+0x6d/0xd0  ethtool_cmis_cdb_init+0x8a/0xd0  ethtool_cmis_fw_update+0x46/0x1d0  module_flash_fw_work+0x17/0xa0  process_one_work+0x179/0x390  worker_thread+0x239/0x340  ? __pfx_worker_thread+0x10/0x10  kthread+0xcc/0x100  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x2d/0x50  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1a/0x30  \u003c/TASK\u003e","modified":"2026-08-27T23:05:28.520296546Z","published":"2025-05-01T14:15:43.540Z","upstream":["CVE-2025-37791"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-37791"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37791.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.25-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37791.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}