Log in Start free

Vulnerability · Published Sep 25, 2026 · Assigned by Linux

CVE-2026-98030net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

High 7.0

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 98.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.190-1DEBIAN-CVE-2026-98030
Debian:13linux6.12.111-1DEBIAN-CVE-2026-98030
Debian:14linux7.2.7-1DEBIAN-CVE-2026-98030
Debian:12linux-6.126.12.111-1~deb12u1DEBIAN-CVE-2026-98030
Ubuntu:22.04:LTSlinux5.15.0-202.212UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-aws5.15.0-1119.126UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure5.15.0-1125.134UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1124.133UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gcp5.15.0-1120.130UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gke5.15.0-1115.121UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1102.110UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-ibm5.15.0-1113.117UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1114.120UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-kvm5.15.0-1111.116UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-197.207UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1114.115UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1070.72UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1059.59UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oracle5.15.0-1116.122UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-98030
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-98030
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-98030
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2026-98030

Affected products (as reported)

VendorProductVersions
Linux Linux 7318166cacad158b46240f66250d7cc5a481653b – before ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e7318166cacad158b46240f66250d7cc5a481653b – before 8e41ce02589c92356bfd8ef62f6ceff840546e1a7318166cacad158b46240f66250d7cc5a481653b – before f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf47318166cacad158b46240f66250d7cc5a481653b – before f5e93162b3dd195bfda815e8f7a39aaf1d45437b7318166cacad158b46240f66250d7cc5a481653b – before f1a2869b3629c0e8394b77b38cb9f19a018c653c7318166cacad158b46240f66250d7cc5a481653b – before fd1a78c16b1f6978c09cf048e15f349732e4c7077318166cacad158b46240f66250d7cc5a481653b – before b231b6d8516d3fe0d4bba549908e08d26a4531a57318166cacad158b46240f66250d7cc5a481653b – before cdb719f4b8596d9ccee2d56d204c2c4dce982f46
Linux Linux 4.11

References