CVE-2026-63995

In the Linux kernel, the following vulnerability has been resolved:

ethtool: cmis: validate startcmdpayload_size from module

The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination buffer is 112 bytes (ETHTOOLCMISCDBLPLMAXPLLENGTH - 8). So a malicious module (or corrupted response) can cause a OOB write later on in cmisfwupdatestart_download().

Let's error out. If modules that expect longer LPL writes actually exist we should revisit.

struct cmiscdbstartfwdownload_pl's definition has to move, no change there.