CVE-2026-98030
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
Severity
HIGH
CVSS score
7.0
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-25 11:17:31.673000
Last modified
2026-10-19 10:17:56.990000
View original CVE JSON
{
"id": "CVE-2026-98030",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-25T11:17:31.673",
"lastModified": "2026-10-19T10:17:56.990",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation. A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/dsa/bcm_sf2_cfp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "8e41ce02589c92356bfd8ef62f6ceff840546e1a",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "f5e93162b3dd195bfda815e8f7a39aaf1d45437b",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
"versionType": "git",
"status": "affected"
},
{
"version": "7318166cacad158b46240f66250d7cc5a481653b",
"lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/dsa/bcm_sf2_cfp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.11",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}