{"id":"CVE-2026-98028","revision":"5c1f5bfee2ff4923ac1a2d9d337e7bca","records":[{"revision":"5c1f5bfee2ff4923ac1a2d9d337e7bca","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98028","aliases":[],"title":"eth: nfp: drop the replaced rule from the list when reprogramming fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: drop the replaced rule from the list when reprogramming fails\n\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one.  If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\n\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter.","state":0,"publishedAt":"2026-09-25T10:23:45.737+00:00","modifiedAt":"2026-10-19T09:12:33.311+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"9eb03bb1c035ff6e2c3a34046419446588253dda\",\n                            \"lessThan\": \"603b70093f729f52a37544b48679903cad834856\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9eb03bb1c035ff6e2c3a34046419446588253dda\",\n                            \"lessThan\": \"edaec279f59f801a05b751df475ed71a0a68c88a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9eb03bb1c035ff6e2c3a34046419446588253dda\",\n                            \"lessThan\": \"552e528a7d85cbe088b2ae4f78194713975b46cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9eb03bb1c035ff6e2c3a34046419446588253dda\",\n                            \"lessThan\": \"108bb2142e3a12c9ad625ad662973127a113ddc6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/603b70093f729f52a37544b48679903cad834856","https://git.kernel.org/stable/c/edaec279f59f801a05b751df475ed71a0a68c88a","https://git.kernel.org/stable/c/552e528a7d85cbe088b2ae4f78194713975b46cf","https://git.kernel.org/stable/c/108bb2142e3a12c9ad625ad662973127a113ddc6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98028","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98028","identifiers":["CVE-2026-98028"]},"retained":false,"historicalAffected":[]}],"coverage":[]}