CVE-2026-98030
Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
How to fix
- Linux Linuxca49c526291d7cd3a5cb49b0edd7f50a5ae7176e, 8e41ce02589c92356bfd8ef62f6ceff840546e1a, f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4, f5e93162b3dd195bfda815e8f7a39aaf1d45437b, f1a2869b3629c0e8394b77b38cb9f19a018c653c, fd1a78c16b1f6978c09cf048e15f349732e4c707, b231b6d8516d3fe0d4bba549908e08d26a4531a5, cdb719f4b8596d9ccee2d56d204c2c4dce982f46 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 7318166cacad158b46240f66250d7cc5a481653b ≤ v < ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < 8e41ce02589c92356bfd8ef62f6ceff840546e1a, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < f5e93162b3dd195bfda815e8f7a39aaf1d45437b, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < f1a2869b3629c0e8394b77b38cb9f19a018c653c, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < fd1a78c16b1f6978c09cf048e15f349732e4c707, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < b231b6d8516d3fe0d4bba549908e08d26a4531a5, 7318166cacad158b46240f66250d7cc5a481653b ≤ v < cdb719f4b8596d9ccee2d56d204c2c4dce982f46, 4.11 | ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e, 8e41ce02589c92356bfd8ef62f6ceff840546e1a, f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4, f5e93162b3dd195bfda815e8f7a39aaf1d45437b, f1a2869b3629c0e8394b77b38cb9f19a018c653c, fd1a78c16b1f6978c09cf048e15f349732e4c707, b231b6d8516d3fe0d4bba549908e08d26a4531a5, cdb719f4b8596d9ccee2d56d204c2c4dce982f46 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.