CVE-2026-97435 (GCVE-0-2026-97435)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:44
VLAI
Title
net: dsa: sja1105: flower: reject cross-chip redirect
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: flower: reject cross-chip redirect dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count. Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dfacc5a23e227cabdff41b6202f510398e90d36b , < c999cc39775381b68ed66eae57c1425452672c0f (git)
Affected: dfacc5a23e227cabdff41b6202f510398e90d36b , < abd7511e12b231798332afa04ed9bee9e84f9445 (git)
Affected: dfacc5a23e227cabdff41b6202f510398e90d36b , < cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/sja1105/sja1105_flower.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c999cc39775381b68ed66eae57c1425452672c0f",
              "status": "affected",
              "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
              "versionType": "git"
            },
            {
              "lessThan": "abd7511e12b231798332afa04ed9bee9e84f9445",
              "status": "affected",
              "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
              "versionType": "git"
            },
            {
              "lessThan": "cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0",
              "status": "affected",
              "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/sja1105/sja1105_flower.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip\u0027s port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip\u0027s port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls-\u003ecommon.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:44:12.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0"
        }
      ],
      "title": "net: dsa: sja1105: flower: reject cross-chip redirect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97435",
    "datePublished": "2026-09-24T16:03:48.116Z",
    "dateReserved": "2026-09-24T14:53:16.869Z",
    "dateUpdated": "2026-09-25T12:44:12.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97435",
      "date": "2026-09-25",
      "epss": "0.00166",
      "percentile": "0.05182"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/sja1105/sja1105_flower.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c999cc39775381b68ed66eae57c1425452672c0f",
                    "status": "affected",
                    "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "abd7511e12b231798332afa04ed9bee9e84f9445",
                    "status": "affected",
                    "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0",
                    "status": "affected",
                    "version": "dfacc5a23e227cabdff41b6202f510398e90d36b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/sja1105/sja1105_flower.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.8"
                  },
                  {
                    "lessThan": "5.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip\u0027s port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip\u0027s port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls-\u003ecommon.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."
          }
        ],
        "id": "CVE-2026-97435",
        "lastModified": "2026-09-25T13:17:27.120",
        "metrics": {},
        "published": "2026-09-24T17:17:21.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-24T23:46:07Z",
      "cve": "CVE-2026-97435",
      "id": "CVE-2026-97435",
      "initial_release_date": "2026-09-24T23:46:07Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-97435",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-97435.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.