CVE-2026-98272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.333Z", "datePublished": "2026-10-06T08:45:33.974Z", "dateUpdated": "2026-10-19T09:16:44.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:16:44.017Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv->page_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "versions": [{"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "dfd46b5584a5881b131008767950e1ab82713c8c", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "e7f30dcfa6c64033bf9137362517bd248e5be384", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "f0e7d62c1eb984dd204095118973c59604144cd8", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "1734c3fc0066e228ce1c11e434b7c2527f0a949a", "status": "affected", "versionType": "git"}, {"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "lessThan": "14cb1e7702e5cb3c58888f6aed498381a73927d2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c"}, {"url": "https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545"}, {"url": "https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c"}, {"url": "https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0"}, {"url": "https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384"}, {"url": "https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8"}, {"url": "https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a"}, {"url": "https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2"}], "title": "net: mvpp2: prevent buffer overflow in page_pool allocation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "dfd46b5584a5881b131008767950e1ab82713c8c", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "e7f30dcfa6c64033bf9137362517bd248e5be384", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "f0e7d62c1eb984dd204095118973c59604144cd8", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "1734c3fc0066e228ce1c11e434b7c2527f0a949a", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}, {"lessThan": "14cb1e7702e5cb3c58888f6aed498381a73927d2", "status": "affected", "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv->page_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}], "id": "CVE-2026-98272", "lastModified": "2026-10-19T10:18:28.490", "metrics": {}, "published": "2026-10-06T09:18:16.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: mvpp2: prevent buffer overflow in page_pool allocation", "id": "2546535", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546535"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: mvpp2: prevent buffer overflow in page_pool allocation\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv->page_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "A flaw was found in the Linux kernel's Marvell mvpp2 network driver. This vulnerability can lead to a Denial of Service (DoS) due to an out-of-bounds memory access. A local user with network configuration privileges can trigger this issue by altering the Maximum Transmission Unit (MTU), which causes the driver to switch buffer allocation schemes without properly validating pool limits, resulting in memory corruption and a system crash."], "name": "CVE-2026-98272", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98272\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98272.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,dfd46b5584a5881b131008767950e1ab82713c8c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,e7f30dcfa6c64033bf9137362517bd248e5be384)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,f0e7d62c1eb984dd204095118973c59604144cd8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,1734c3fc0066e228ce1c11e434b7c2527f0a949a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7d04b0b13b1175ce0c4bdc77f1278c1f120f874f,14cb1e7702e5cb3c58888f6aed498381a73927d2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T12:30:10.406012+00:00", "updated": "2026-10-09T17:00:09.859020+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}