CVE-2026-98028

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98028", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:45.737Z", "dateUpdated": "2026-10-19T09:12:33.311Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:33.311Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: drop the replaced rule from the list when reprogramming fails\n\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one. If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\n\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"], "versions": [{"version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "lessThan": "603b70093f729f52a37544b48679903cad834856", "status": "affected", "versionType": "git"}, {"version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "lessThan": "edaec279f59f801a05b751df475ed71a0a68c88a", "status": "affected", "versionType": "git"}, {"version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "lessThan": "552e528a7d85cbe088b2ae4f78194713975b46cf", "status": "affected", "versionType": "git"}, {"version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "lessThan": "108bb2142e3a12c9ad625ad662973127a113ddc6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/603b70093f729f52a37544b48679903cad834856"}, {"url": "https://git.kernel.org/stable/c/edaec279f59f801a05b751df475ed71a0a68c88a"}, {"url": "https://git.kernel.org/stable/c/552e528a7d85cbe088b2ae4f78194713975b46cf"}, {"url": "https://git.kernel.org/stable/c/108bb2142e3a12c9ad625ad662973127a113ddc6"}], "title": "eth: nfp: drop the replaced rule from the list when reprogramming fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "603b70093f729f52a37544b48679903cad834856", "status": "affected", "version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "versionType": "git"}, {"lessThan": "edaec279f59f801a05b751df475ed71a0a68c88a", "status": "affected", "version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "versionType": "git"}, {"lessThan": "552e528a7d85cbe088b2ae4f78194713975b46cf", "status": "affected", "version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "versionType": "git"}, {"lessThan": "108bb2142e3a12c9ad625ad662973127a113ddc6", "status": "affected", "version": "9eb03bb1c035ff6e2c3a34046419446588253dda", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: drop the replaced rule from the list when reprogramming fails\n\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one. If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\n\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter."}], "id": "CVE-2026-98028", "lastModified": "2026-10-19T10:17:56.787", "metrics": {}, "published": "2026-09-25T11:17:31.447", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/108bb2142e3a12c9ad625ad662973127a113ddc6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/552e528a7d85cbe088b2ae4f78194713975b46cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/603b70093f729f52a37544b48679903cad834856"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/edaec279f59f801a05b751df475ed71a0a68c88a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: eth: nfp: drop the replaced rule from the list when reprogramming fails", "id": "2541051", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541051"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\neth: nfp: drop the replaced rule from the list when reprogramming fails\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one. If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter.", "A flaw was found in the Linux kernel's Netronome Flow Processor (NFP) network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local user with network administration privileges could trigger this condition, causing subsequent flow rule queries to fail permanently or potentially resulting in memory corruption. This issue primarily leads to a Denial of Service (DoS) for network management operations."], "name": "CVE-2026-98028", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98028\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98028\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98028.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9eb03bb1c035ff6e2c3a34046419446588253dda,603b70093f729f52a37544b48679903cad834856)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9eb03bb1c035ff6e2c3a34046419446588253dda,edaec279f59f801a05b751df475ed71a0a68c88a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9eb03bb1c035ff6e2c3a34046419446588253dda,552e528a7d85cbe088b2ae4f78194713975b46cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9eb03bb1c035ff6e2c3a34046419446588253dda,108bb2142e3a12c9ad625ad662973127a113ddc6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:15:14.510757+00:00", "title": "Stale Network Filter Rule Causing ETHTOOL EMSGSIZE Errors in Linux Kernel", "updated": "2026-09-30T14:45:07.235794+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}