CVE-2026-98027

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98027", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:45.123Z", "dateUpdated": "2026-10-19T09:12:32.331Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:32.331Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at. That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation. A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflow is reached only through the local SIOCETHTOOL ioctl: dev_ethtool() -> ethtool_get_rxnfc() -> dsa_user_get_rxnfc() -> mv88e6xxx_get_rxnfc(ETHTOOL_GRXCLSRLALL). The bad input is the rule_cnt field of the ethtool_rxnfc struct the user passes in. No network packet reaches this path.\nAC:H - The OOB write only happens if policy rules already exist in chip->policies for that DSA port. Those are installed by an admin via ETHTOOL_SRXCLSRLINS, which needs CAP_NET_ADMIN over the hardware port. The attacker can't create that state. Once rules exist, a small rule_cnt triggers it deterministically.\nPR:L - dev_ethtool() lists ETHTOOL_GRXCLSRLALL among the commands exempt from the ns_capable(CAP_NET_ADMIN) check. Any unprivileged local user who can see the mv88e6xxx user port in their netns can issue the ioctl.\nUI:N - The attacker makes the ioctl call and picks rule_cnt themselves. No other user has to do anything.\nS:U - The corruption hits the kernel heap in the same kernel that runs the attacker's ioctl. No VM, IOMMU or other authority boundary is crossed.\nC:H - ethtool_get_rxnfc() sizes rule_buf with kcalloc(rule_cnt, 4) from the user's value. The driver then overwrites rxnfc->rule_cnt with the real rule count, so ethtool_rxnfc_copy_to_user() copies that many u32s from the undersized buffer, reading past the slab object into userspace. The same heap corruption can also be groomed to leak more.\nI:H - mv88e6xxx_get_rxnfc() writes rule_locs[rxnfc->rule_cnt++] = id for every rule on the port with no bound, so u32 IDs go past a kmalloc object whose size and cache the attacker chose via rule_cnt. That heap OOB write can corrupt neighbouring objects.\nA:H - With rule_cnt=0, ethtool_get_rxnfc() passes a NULL rule_buf and the IDR walk writes through it, oopsing the kernel on demand. Larger overflows corrupt slab memory and can panic the system. Either can be repeated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/dsa/mv88e6xxx/chip.c"], "versions": [{"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "7e4bfc5f0b66feb22cba821303fc25ca22cd0887", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "01124cd2cf4b71755b1130ac82d78dcfbd5d69e3", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "609c4378f212cf580aae02250f1146caf63d873f", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "c5b5c52b6524c9fb50def2260baac745c095ec3a", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "44cd4674d9aa5bdf793b8a8b481c9e8536ed6070", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "7a683c2b062810bca203e41866389daf387c235b", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "cda5ac8fe8ac8e80b1703ebb8c4250726fc19739", "status": "affected", "versionType": "git"}, {"version": "da7dc87553046a43be1620a783ce3d9f6583d322", "lessThan": "b1fffc273112e7284c5b705e186b43b5770cd3d5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/dsa/mv88e6xxx/chip.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887"}, {"url": "https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3"}, {"url": "https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f"}, {"url": "https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a"}, {"url": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"}, {"url": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b"}, {"url": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"}, {"url": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5"}], "title": "net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/dsa/mv88e6xxx/chip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7e4bfc5f0b66feb22cba821303fc25ca22cd0887", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "01124cd2cf4b71755b1130ac82d78dcfbd5d69e3", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "609c4378f212cf580aae02250f1146caf63d873f", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "c5b5c52b6524c9fb50def2260baac745c095ec3a", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "44cd4674d9aa5bdf793b8a8b481c9e8536ed6070", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "7a683c2b062810bca203e41866389daf387c235b", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "cda5ac8fe8ac8e80b1703ebb8c4250726fc19739", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}, {"lessThan": "b1fffc273112e7284c5b705e186b43b5770cd3d5", "status": "affected", "version": "da7dc87553046a43be1620a783ce3d9f6583d322", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/dsa/mv88e6xxx/chip.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at. That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation. A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached."}], "id": "CVE-2026-98027", "lastModified": "2026-10-19T10:17:56.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:31.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size", "id": "2541198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541198"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\nmv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at. That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation. A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached.", "A flaw was found in the Linux kernel's Marvell 88E6xxx switch driver. The driver fails to validate the caller's buffer boundary when retrieving network policy rules, leading to memory writes beyond the allocated buffer or a null pointer dereference. A local unprivileged user can exploit this vulnerability by requesting fewer rule slots than installed, resulting in a system crash and Denial of Service (DoS) or potential privilege escalation."], "name": "CVE-2026-98027", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98027\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98027\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98027.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da7dc87553046a43be1620a783ce3d9f6583d322,44cd4674d9aa5bdf793b8a8b481c9e8536ed6070)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da7dc87553046a43be1620a783ce3d9f6583d322,7a683c2b062810bca203e41866389daf387c235b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da7dc87553046a43be1620a783ce3d9f6583d322,cda5ac8fe8ac8e80b1703ebb8c4250726fc19739)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da7dc87553046a43be1620a783ce3d9f6583d322,b1fffc273112e7284c5b705e186b43b5770cd3d5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:15:14.510903+00:00", "updated": "2026-09-30T14:15:16.123202+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}