CVE-2026-98030 (GCVE-0-2026-98030)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:12
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
Version: 7318166cacad158b46240f66250d7cc5a481653b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "8e41ce02589c92356bfd8ef62f6ceff840546e1a",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "f5e93162b3dd195bfda815e8f7a39aaf1d45437b",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc-\u003erule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is the local SIOCETHTOOL ioctl with ETHTOOL_GRXCLSRLALL on a bcm_sf2 DSA user port. The path is ethtool_get_rxnfc() -\u003e dsa_user_get_rxnfc() -\u003e bcm_sf2_get_rxnfc() -\u003e bcm_sf2_cfp_rule_get_all(). The bad rule_cnt comes from userspace, and no packet from a remote peer is involved.\nAC:H - The overflow needs CFP rules installed beyond the default at bit 0 of cfp.unique, since the walk starts at index 1. Installing them via ETHTOOL_SRXCLSRLINS needs CAP_NET_ADMIN over the switch\u0027s netns, so the unprivileged attacker cannot create the rule state. Once rules exist, the bug fires every time.\nPR:L - ETHTOOL_GRXCLSRLALL is on ethtool\u0027s no-capability list in net/ethtool/ioctl.c, so any unprivileged local user who can open a socket in the netns holding the DSA port can send the dump request.\nUI:N - The attacker issues the ioctl themselves and picks rule_cnt. No other user has to act.\nS:U - Both the memory corruption and the leak stay inside the kernel\u0027s own security authority, with no VM or IOMMU boundary crossed.\nC:H - After the walk, nfc-\u003erule_cnt holds the real rule count, which can be larger than the buffer. ethtool_rxnfc_copy_to_user() then copies rule_cnt*4 bytes from the undersized kcalloc buffer to userspace. That leaks up to about 1 KB of adjacent heap from a slab cache the attacker chooses.\nI:H - bcm_sf2_cfp_rule_get_all() writes u32 rule indices past a kcalloc(rule_cnt) buffer sized by the user. This is a heap out-of-bounds write into neighbouring objects in a slab cache the attacker picks, and it can corrupt kernel data structures.\nA:H - With rule_cnt=0 the rule_locs buffer stays NULL, so the walk writes through a NULL pointer and the kernel oopses. Any user can repeat this at will once rules are installed. Heap corruption from the out-of-bounds write can also crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:12:35.325Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"
        },
        {
          "url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"
        }
      ],
      "title": "net: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98030",
    "datePublished": "2026-09-25T10:23:46.959Z",
    "dateReserved": "2026-09-25T10:19:56.070Z",
    "dateUpdated": "2026-10-19T09:12:35.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.