{"id":"CVE-2026-98030","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 7318166cacad158b46240f66250d7cc5a481653b < f1a2869b3629c0e8394b77b38cb9f19a018c653c","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < fd1a78c16b1f6978c09cf048e15f349732e4c707","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < b231b6d8516d3fe0d4bba549908e08d26a4531a5","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < cdb719f4b8596d9ccee2d56d204c2c4dce982f46","Linux 4.11"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T11:17:31.673","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98030","references":[{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.853Z","slug":"CVE-2026-98030","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}