{"id":"CVE-2026-98030","revision":"cc17e0a1731c423faf96e8ea7cfa0c4a","records":[{"revision":"cc17e0a1731c423faf96e8ea7cfa0c4a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98030","aliases":[],"title":"net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.","state":0,"publishedAt":"2026-09-25T10:23:46.959+00:00","modifiedAt":"2026-10-19T09:12:35.325+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/dsa/bcm_sf2_cfp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"8e41ce02589c92356bfd8ef62f6ceff840546e1a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"f5e93162b3dd195bfda815e8f7a39aaf1d45437b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"f1a2869b3629c0e8394b77b38cb9f19a018c653c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"fd1a78c16b1f6978c09cf048e15f349732e4c707\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"b231b6d8516d3fe0d4bba549908e08d26a4531a5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7318166cacad158b46240f66250d7cc5a481653b\",\n                            \"lessThan\": \"cdb719f4b8596d9ccee2d56d204c2c4dce982f46\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/dsa/bcm_sf2_cfp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a","https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b","https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98030","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98030","identifiers":["CVE-2026-98030"]},"retained":false,"historicalAffected":[]}],"coverage":[]}