CVE-2026-97435

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97435", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T14:53:16.869Z", "datePublished": "2026-09-24T16:03:48.116Z", "dateUpdated": "2026-10-03T10:58:19.848Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:58:19.848Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip's port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip's port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls->common.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/dsa/sja1105/sja1105_flower.c"], "versions": [{"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "6bf5158af52a5293e9160d8f2992c629ca14aa7d", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "277f8611e017d3ff1ab06af58a6c538b55da1cc8", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "eb177aa00c392de3dc530c34f173a962216f82dd", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "d0e54098c072b6064cdcf8039075ada8b88583da", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "c999cc39775381b68ed66eae57c1425452672c0f", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "abd7511e12b231798332afa04ed9bee9e84f9445", "status": "affected", "versionType": "git"}, {"version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "lessThan": "cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/dsa/sja1105/sja1105_flower.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6bf5158af52a5293e9160d8f2992c629ca14aa7d"}, {"url": "https://git.kernel.org/stable/c/277f8611e017d3ff1ab06af58a6c538b55da1cc8"}, {"url": "https://git.kernel.org/stable/c/eb177aa00c392de3dc530c34f173a962216f82dd"}, {"url": "https://git.kernel.org/stable/c/d0e54098c072b6064cdcf8039075ada8b88583da"}, {"url": "https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f"}, {"url": "https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445"}, {"url": "https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0"}], "title": "net: dsa: sja1105: flower: reject cross-chip redirect", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/dsa/sja1105/sja1105_flower.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6bf5158af52a5293e9160d8f2992c629ca14aa7d", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "277f8611e017d3ff1ab06af58a6c538b55da1cc8", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "eb177aa00c392de3dc530c34f173a962216f82dd", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "d0e54098c072b6064cdcf8039075ada8b88583da", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "c999cc39775381b68ed66eae57c1425452672c0f", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "abd7511e12b231798332afa04ed9bee9e84f9445", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}, {"lessThan": "cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0", "status": "affected", "version": "dfacc5a23e227cabdff41b6202f510398e90d36b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/dsa/sja1105/sja1105_flower.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip's port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip's port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls->common.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."}], "id": "CVE-2026-97435", "lastModified": "2026-10-03T11:17:54.967", "metrics": {}, "published": "2026-09-24T17:17:21.573", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/277f8611e017d3ff1ab06af58a6c538b55da1cc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6bf5158af52a5293e9160d8f2992c629ca14aa7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0e54098c072b6064cdcf8039075ada8b88583da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb177aa00c392de3dc530c34f173a962216f82dd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: dsa: sja1105: flower: reject cross-chip redirect", "id": "2540521", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540521"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: dsa: sja1105: flower: reject cross-chip redirect\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip's port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip's port count.\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls->common.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here.", "A flaw was found in the Linux kernel's sja1105 network switch driver. When configuring traffic control redirect actions, the driver does not verify whether the destination port belongs to the local switch device. A local privileged user could exploit this flaw by configuring a cross-chip redirect, causing the driver to program an invalid port index into the hardware. This issue can lead to packets being routed to an incorrect port or an out-of-bounds access that results in a Denial of Service (DoS)."], "name": "CVE-2026-97435", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97435\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97435\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97435.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c999cc39775381b68ed66eae57c1425452672c0f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,abd7511e12b231798332afa04ed9bee9e84f9445)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T22:15:16.910712+00:00", "updated": "2026-10-01T21:30:13.219329+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}