CVE-2026-98027 (GCVE-0-2026-98027)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41
VLAI
Title
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input is the number of entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed policy rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it. Count into a local so the caller's limit survives the walk, and stop with -EMSGSIZE once it is reached.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: da7dc87553046a43be1620a783ce3d9f6583d322 , < 44cd4674d9aa5bdf793b8a8b481c9e8536ed6070 (git)
Affected: da7dc87553046a43be1620a783ce3d9f6583d322 , < 7a683c2b062810bca203e41866389daf387c235b (git)
Affected: da7dc87553046a43be1620a783ce3d9f6583d322 , < cda5ac8fe8ac8e80b1703ebb8c4250726fc19739 (git)
Affected: da7dc87553046a43be1620a783ce3d9f6583d322 , < b1fffc273112e7284c5b705e186b43b5770cd3d5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/mv88e6xxx/chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44cd4674d9aa5bdf793b8a8b481c9e8536ed6070",
              "status": "affected",
              "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
              "versionType": "git"
            },
            {
              "lessThan": "7a683c2b062810bca203e41866389daf387c235b",
              "status": "affected",
              "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
              "versionType": "git"
            },
            {
              "lessThan": "cda5ac8fe8ac8e80b1703ebb8c4250726fc19739",
              "status": "affected",
              "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
              "versionType": "git"
            },
            {
              "lessThan": "b1fffc273112e7284c5b705e186b43b5770cd3d5",
              "status": "affected",
              "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/mv88e6xxx/chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller\u0027s buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc-\u003erule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at.  That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation.  A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller\u0027s limit survives the walk, and stop with\n-EMSGSIZE once it is reached."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through the local SIOCETHTOOL ioctl: dev_ethtool() -\u003e ethtool_get_rxnfc() -\u003e dsa_user_get_rxnfc() -\u003e mv88e6xxx_get_rxnfc(ETHTOOL_GRXCLSRLALL). The bad input is the rule_cnt field of the ethtool_rxnfc struct the user passes in. No network packet reaches this path.\nAC:H - The OOB write only happens if policy rules already exist in chip-\u003epolicies for that DSA port. Those are installed by an admin via ETHTOOL_SRXCLSRLINS, which needs CAP_NET_ADMIN over the hardware port. The attacker can\u0027t create that state. Once rules exist, a small rule_cnt triggers it deterministically.\nPR:L - dev_ethtool() lists ETHTOOL_GRXCLSRLALL among the commands exempt from the ns_capable(CAP_NET_ADMIN) check. Any unprivileged local user who can see the mv88e6xxx user port in their netns can issue the ioctl.\nUI:N - The attacker makes the ioctl call and picks rule_cnt themselves. No other user has to do anything.\nS:U - The corruption hits the kernel heap in the same kernel that runs the attacker\u0027s ioctl. No VM, IOMMU or other authority boundary is crossed.\nC:H - ethtool_get_rxnfc() sizes rule_buf with kcalloc(rule_cnt, 4) from the user\u0027s value. The driver then overwrites rxnfc-\u003erule_cnt with the real rule count, so ethtool_rxnfc_copy_to_user() copies that many u32s from the undersized buffer, reading past the slab object into userspace. The same heap corruption can also be groomed to leak more.\nI:H - mv88e6xxx_get_rxnfc() writes rule_locs[rxnfc-\u003erule_cnt++] = id for every rule on the port with no bound, so u32 IDs go past a kmalloc object whose size and cache the attacker chose via rule_cnt. That heap OOB write can corrupt neighbouring objects.\nA:H - With rule_cnt=0, ethtool_get_rxnfc() passes a NULL rule_buf and the IDR walk writes through it, oopsing the kernel on demand. Larger overflows corrupt slab memory and can panic the system. Either can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:52.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5"
        }
      ],
      "title": "net: dsa: mv88e6xxx: bound the policy rule dump by the caller\u0027s buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98027",
    "datePublished": "2026-09-25T10:23:45.123Z",
    "dateReserved": "2026-09-25T10:19:56.070Z",
    "dateUpdated": "2026-09-25T14:41:52.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98027",
      "date": "2026-09-26",
      "epss": "0.00121",
      "percentile": "0.01695"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/mv88e6xxx/chip.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "44cd4674d9aa5bdf793b8a8b481c9e8536ed6070",
                    "status": "affected",
                    "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a683c2b062810bca203e41866389daf387c235b",
                    "status": "affected",
                    "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cda5ac8fe8ac8e80b1703ebb8c4250726fc19739",
                    "status": "affected",
                    "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b1fffc273112e7284c5b705e186b43b5770cd3d5",
                    "status": "affected",
                    "version": "da7dc87553046a43be1620a783ce3d9f6583d322",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/mv88e6xxx/chip.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.4"
                  },
                  {
                    "lessThan": "5.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller\u0027s buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc-\u003erule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at.  That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation.  A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller\u0027s limit survives the walk, and stop with\n-EMSGSIZE once it is reached."
          }
        ],
        "id": "CVE-2026-98027",
        "lastModified": "2026-09-25T15:18:04.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:31.340",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.