{"api_version":"1","generated_at":"2026-10-25T08:26:20+00:00","cve":"CVE-2026-98030","urls":{"html":"https://cve.report/CVE-2026-98030","api":"https://cve.report/api/cve/CVE-2026-98030.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98030","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98030"},"summary":{"title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:31","updated_at":"2026-10-19 10:17:56"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","name":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","name":"https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a","name":"https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","name":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","name":"https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","name":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","name":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b","name":"https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98030","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98030","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b 8e41ce02589c92356bfd8ef62f6ceff840546e1a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b f5e93162b3dd195bfda815e8f7a39aaf1d45437b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b f1a2869b3629c0e8394b77b38cb9f19a018c653c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b fd1a78c16b1f6978c09cf048e15f349732e4c707 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b b231b6d8516d3fe0d4bba549908e08d26a4531a5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7318166cacad158b46240f66250d7cc5a481653b cdb719f4b8596d9ccee2d56d204c2c4dce982f46 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.271 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.222 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.189 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"98030","cve":"CVE-2026-98030","epss":"0.001220000","percentile":"0.017300000","score_date":"2026-10-05","updated_at":"2026-10-06 00:14:18"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/dsa/bcm_sf2_cfp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"8e41ce02589c92356bfd8ef62f6ceff840546e1a","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"f5e93162b3dd195bfda815e8f7a39aaf1d45437b","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"f1a2869b3629c0e8394b77b38cb9f19a018c653c","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"fd1a78c16b1f6978c09cf048e15f349732e4c707","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"b231b6d8516d3fe0d4bba549908e08d26a4531a5","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"},{"lessThan":"cdb719f4b8596d9ccee2d56d204c2c4dce982f46","status":"affected","version":"7318166cacad158b46240f66250d7cc5a481653b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/dsa/bcm_sf2_cfp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.271","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.222","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.189","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.271","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.222","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.189","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"4.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The trigger is the local SIOCETHTOOL ioctl with ETHTOOL_GRXCLSRLALL on a bcm_sf2 DSA user port. The path is ethtool_get_rxnfc() -> dsa_user_get_rxnfc() -> bcm_sf2_get_rxnfc() -> bcm_sf2_cfp_rule_get_all(). The bad rule_cnt comes from userspace, and no packet from a remote peer is involved.\nAC:H - The overflow needs CFP rules installed beyond the default at bit 0 of cfp.unique, since the walk starts at index 1. Installing them via ETHTOOL_SRXCLSRLINS needs CAP_NET_ADMIN over the switch's netns, so the unprivileged attacker cannot create the rule state. Once rules exist, the bug fires every time.\nPR:L - ETHTOOL_GRXCLSRLALL is on ethtool's no-capability list in net/ethtool/ioctl.c, so any unprivileged local user who can open a socket in the netns holding the DSA port can send the dump request.\nUI:N - The attacker issues the ioctl themselves and picks rule_cnt. No other user has to act.\nS:U - Both the memory corruption and the leak stay inside the kernel's own security authority, with no VM or IOMMU boundary crossed.\nC:H - After the walk, nfc->rule_cnt holds the real rule count, which can be larger than the buffer. ethtool_rxnfc_copy_to_user() then copies rule_cnt*4 bytes from the undersized kcalloc buffer to userspace. That leaks up to about 1 KB of adjacent heap from a slab cache the attacker chooses.\nI:H - bcm_sf2_cfp_rule_get_all() writes u32 rule indices past a kcalloc(rule_cnt) buffer sized by the user. This is a heap out-of-bounds write into neighbouring objects in a slab cache the attacker picks, and it can corrupt kernel data structures.\nA:H - With rule_cnt=0 the rule_locs buffer stays NULL, so the walk writes through a NULL pointer and the kernel oopses. Any user can repeat this at will once rules are installed. Heap corruption from the out-of-bounds write can also crash the system."}]}],"providerMetadata":{"dateUpdated":"2026-10-19T09:12:35.325Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e"},{"url":"https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a"},{"url":"https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4"},{"url":"https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b"},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c"},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707"},{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5"},{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"}],"title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98030","datePublished":"2026-09-25T10:23:46.959Z","dateReserved":"2026-09-25T10:19:56.070Z","dateUpdated":"2026-10-19T09:12:35.325Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:31","lastModifiedDate":"2026-10-19 10:17:56","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98030","Ordinal":"1","Title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffe","CVE":"CVE-2026-98030","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98030","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.","Type":"Description","Title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffe"}]}}}