CVE-2026-98030 (GCVE-0-2026-98030)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41
VLAI
Title
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7318166cacad158b46240f66250d7cc5a481653b , < f1a2869b3629c0e8394b77b38cb9f19a018c653c (git)
Affected: 7318166cacad158b46240f66250d7cc5a481653b , < fd1a78c16b1f6978c09cf048e15f349732e4c707 (git)
Affected: 7318166cacad158b46240f66250d7cc5a481653b , < b231b6d8516d3fe0d4bba549908e08d26a4531a5 (git)
Affected: 7318166cacad158b46240f66250d7cc5a481653b , < cdb719f4b8596d9ccee2d56d204c2c4dce982f46 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc-\u003erule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is the local SIOCETHTOOL ioctl with ETHTOOL_GRXCLSRLALL on a bcm_sf2 DSA user port. The path is ethtool_get_rxnfc() -\u003e dsa_user_get_rxnfc() -\u003e bcm_sf2_get_rxnfc() -\u003e bcm_sf2_cfp_rule_get_all(). The bad rule_cnt comes from userspace, and no packet from a remote peer is involved.\nAC:H - The overflow needs CFP rules installed beyond the default at bit 0 of cfp.unique, since the walk starts at index 1. Installing them via ETHTOOL_SRXCLSRLINS needs CAP_NET_ADMIN over the switch\u0027s netns, so the unprivileged attacker cannot create the rule state. Once rules exist, the bug fires every time.\nPR:L - ETHTOOL_GRXCLSRLALL is on ethtool\u0027s no-capability list in net/ethtool/ioctl.c, so any unprivileged local user who can open a socket in the netns holding the DSA port can send the dump request.\nUI:N - The attacker issues the ioctl themselves and picks rule_cnt. No other user has to act.\nS:U - Both the memory corruption and the leak stay inside the kernel\u0027s own security authority, with no VM or IOMMU boundary crossed.\nC:H - After the walk, nfc-\u003erule_cnt holds the real rule count, which can be larger than the buffer. ethtool_rxnfc_copy_to_user() then copies rule_cnt*4 bytes from the undersized kcalloc buffer to userspace. That leaks up to about 1 KB of adjacent heap from a slab cache the attacker chooses.\nI:H - bcm_sf2_cfp_rule_get_all() writes u32 rule indices past a kcalloc(rule_cnt) buffer sized by the user. This is a heap out-of-bounds write into neighbouring objects in a slab cache the attacker picks, and it can corrupt kernel data structures.\nA:H - With rule_cnt=0 the rule_locs buffer stays NULL, so the walk writes through a NULL pointer and the kernel oopses. Any user can repeat this at will once rules are installed. Heap corruption from the out-of-bounds write can also crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:54.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"
        },
        {
          "url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"
        }
      ],
      "title": "net: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98030",
    "datePublished": "2026-09-25T10:23:46.959Z",
    "dateReserved": "2026-09-25T10:19:56.070Z",
    "dateUpdated": "2026-09-25T14:41:54.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98030",
      "date": "2026-09-26",
      "epss": "0.00121",
      "percentile": "0.01695"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/bcm_sf2_cfp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
                    "status": "affected",
                    "version": "7318166cacad158b46240f66250d7cc5a481653b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
                    "status": "affected",
                    "version": "7318166cacad158b46240f66250d7cc5a481653b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
                    "status": "affected",
                    "version": "7318166cacad158b46240f66250d7cc5a481653b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
                    "status": "affected",
                    "version": "7318166cacad158b46240f66250d7cc5a481653b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/dsa/bcm_sf2_cfp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc-\u003erule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
          }
        ],
        "id": "CVE-2026-98030",
        "lastModified": "2026-09-25T15:18:04.627",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:31.673",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.