CVE-2026-98030

Received Received - Intake

Buffer Overflow in Linux Kernel DSA BCM SF2

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98030

EUVD

EUVD-2026-86683

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow issue in the bcm_sf2 network driver. The function bcm_sf2_cfp_rule_get_all() incorrectly processes CFP rules without checking the caller's buffer size, leading to potential out-of-bounds memory access when a user requests fewer rules than exist.

Detection Guidance

This vulnerability involves a buffer overflow in the Linux kernel's bcm_sf2 driver due to improper handling of CFP rule dumps. Detection requires checking kernel versions and examining network driver configurations for potential exposure. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker could exploit this to crash the system or execute arbitrary code with kernel privileges. Even non-privileged users can trigger the flaw by requesting fewer rules than available, causing memory corruption.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by allowing unauthorized users to access or manipulate network traffic rules due to buffer overflow in the Linux kernel's CFP rule handling. Exploitation may lead to unauthorized data exposure or network manipulation, which are critical concerns under these regulations.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Since the vulnerability is in the kernel's network subsystem, applying the latest stable kernel release is recommended. Monitor vendor advisories for specific patches.

Hi! I’m here to help you understand CVE-2026-98030. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70