Vulnerability-Lookup

FKIE_CVE-2026-98030

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 15:18

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc-\u003erule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
    }
  ],
  "id": "CVE-2026-98030",
  "lastModified": "2026-09-25T15:18:04.627",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T11:17:31.673",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-98030 (GCVE-0-2026-98030)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:23 – Updated: 2026-09-25 14:41

Title

net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

Summary

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/f1a2869b3629c0e83…
https://git.kernel.org/stable/c/fd1a78c16b1f6978c…
https://git.kernel.org/stable/c/b231b6d8516d3fe0d…
https://git.kernel.org/stable/c/cdb719f4b8596d9cc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7318166cacad158b46240f66250d7cc5a481653b , < f1a2869b3629c0e8394b77b38cb9f19a018c653c (git) Affected: 7318166cacad158b46240f66250d7cc5a481653b , < fd1a78c16b1f6978c09cf048e15f349732e4c707 (git) Affected: 7318166cacad158b46240f66250d7cc5a481653b , < b231b6d8516d3fe0d4bba549908e08d26a4531a5 (git) Affected: 7318166cacad158b46240f66250d7cc5a481653b , < cdb719f4b8596d9ccee2d56d204c2c4dce982f46 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1a2869b3629c0e8394b77b38cb9f19a018c653c",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "fd1a78c16b1f6978c09cf048e15f349732e4c707",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "b231b6d8516d3fe0d4bba549908e08d26a4531a5",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            },
            {
              "lessThan": "cdb719f4b8596d9ccee2d56d204c2c4dce982f46",
              "status": "affected",
              "version": "7318166cacad158b46240f66250d7cc5a481653b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/dsa/bcm_sf2_cfp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc-\u003erule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is the local SIOCETHTOOL ioctl with ETHTOOL_GRXCLSRLALL on a bcm_sf2 DSA user port. The path is ethtool_get_rxnfc() -\u003e dsa_user_get_rxnfc() -\u003e bcm_sf2_get_rxnfc() -\u003e bcm_sf2_cfp_rule_get_all(). The bad rule_cnt comes from userspace, and no packet from a remote peer is involved.\nAC:H - The overflow needs CFP rules installed beyond the default at bit 0 of cfp.unique, since the walk starts at index 1. Installing them via ETHTOOL_SRXCLSRLINS needs CAP_NET_ADMIN over the switch\u0027s netns, so the unprivileged attacker cannot create the rule state. Once rules exist, the bug fires every time.\nPR:L - ETHTOOL_GRXCLSRLALL is on ethtool\u0027s no-capability list in net/ethtool/ioctl.c, so any unprivileged local user who can open a socket in the netns holding the DSA port can send the dump request.\nUI:N - The attacker issues the ioctl themselves and picks rule_cnt. No other user has to act.\nS:U - Both the memory corruption and the leak stay inside the kernel\u0027s own security authority, with no VM or IOMMU boundary crossed.\nC:H - After the walk, nfc-\u003erule_cnt holds the real rule count, which can be larger than the buffer. ethtool_rxnfc_copy_to_user() then copies rule_cnt*4 bytes from the undersized kcalloc buffer to userspace. That leaks up to about 1 KB of adjacent heap from a slab cache the attacker chooses.\nI:H - bcm_sf2_cfp_rule_get_all() writes u32 rule indices past a kcalloc(rule_cnt) buffer sized by the user. This is a heap out-of-bounds write into neighbouring objects in a slab cache the attacker picks, and it can corrupt kernel data structures.\nA:H - With rule_cnt=0 the rule_locs buffer stays NULL, so the walk writes through a NULL pointer and the kernel oopses. Any user can repeat this at will once rules are installed. Heap corruption from the out-of-bounds write can also crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:54.911Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"
        },
        {
          "url": "https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"
        }
      ],
      "title": "net: dsa: bcm_sf2: bound the CFP rule dump by the caller\u0027s buffer size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98030",
    "datePublished": "2026-09-25T10:23:46.959Z",
    "dateReserved": "2026-09-25T10:19:56.070Z",
    "dateUpdated": "2026-09-25T14:41:54.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-98030

CVE-2026-98030 (GCVE-0-2026-98030)

Tags

Sightings

Nomenclature

Related by attack behaviour