CVE-2026-98808

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98808", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:48:55.053Z", "dateUpdated": "2026-10-21T12:57:08.174Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:57:08.174Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: Fix buffer overflow in bcm_sysport_get_stats()\n\nWhen running on SYSTEMPORT Lite, certain statistics are unsupported and\nskipped during bcm_sysport_get_stats(). The variable 'j' tracks the\ncompacted index into the destination data buffer, whereas 'i' iterates\nover all elements in bcm_sysport_gstrings_stats.\n\nBecause the buffer allocated by ethtool is sized only according to\nbcm_sysport_get_sset_count(), storing values at data[i] instead of\ndata[j] writes past the allocated array bounds, leading to memory\ncorruption.\n\nFix this by writing to data[j] instead of data[i]."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bcmsysport.c"], "versions": [{"version": "10377ba7673d19e28d92846955d51f49acd25c35", "lessThan": "96a2b042051553df0d9f03b518dd3b7105b36935", "status": "affected", "versionType": "git"}, {"version": "10377ba7673d19e28d92846955d51f49acd25c35", "lessThan": "29d1d35ad5ad379a904263ea1cd4ba1d71cd965f", "status": "affected", "versionType": "git"}, {"version": "10377ba7673d19e28d92846955d51f49acd25c35", "lessThan": "96d8b26be5bc451188acdcee055948da45adbde0", "status": "affected", "versionType": "git"}, {"version": "10377ba7673d19e28d92846955d51f49acd25c35", "lessThan": "faba9fdde480356f4a1d3b1a5713b7b354858a1c", "status": "affected", "versionType": "git"}, {"version": "10377ba7673d19e28d92846955d51f49acd25c35", "lessThan": "eb7b84af0ec5c71b4920e999611b466b3784496c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bcmsysport.c"], "versions": [{"version": "4.14", "status": "affected"}, {"version": "0", "lessThan": "4.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/96a2b042051553df0d9f03b518dd3b7105b36935"}, {"url": "https://git.kernel.org/stable/c/29d1d35ad5ad379a904263ea1cd4ba1d71cd965f"}, {"url": "https://git.kernel.org/stable/c/96d8b26be5bc451188acdcee055948da45adbde0"}, {"url": "https://git.kernel.org/stable/c/faba9fdde480356f4a1d3b1a5713b7b354858a1c"}, {"url": "https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}], "title": "net: systemport: Fix buffer overflow in bcm_sysport_get_stats()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bcmsysport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "96a2b042051553df0d9f03b518dd3b7105b36935", "status": "affected", "version": "10377ba7673d19e28d92846955d51f49acd25c35", "versionType": "git"}, {"lessThan": "29d1d35ad5ad379a904263ea1cd4ba1d71cd965f", "status": "affected", "version": "10377ba7673d19e28d92846955d51f49acd25c35", "versionType": "git"}, {"lessThan": "96d8b26be5bc451188acdcee055948da45adbde0", "status": "affected", "version": "10377ba7673d19e28d92846955d51f49acd25c35", "versionType": "git"}, {"lessThan": "faba9fdde480356f4a1d3b1a5713b7b354858a1c", "status": "affected", "version": "10377ba7673d19e28d92846955d51f49acd25c35", "versionType": "git"}, {"lessThan": "eb7b84af0ec5c71b4920e999611b466b3784496c", "status": "affected", "version": "10377ba7673d19e28d92846955d51f49acd25c35", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bcmsysport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.14"}, {"lessThan": "4.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: Fix buffer overflow in bcm_sysport_get_stats()\n\nWhen running on SYSTEMPORT Lite, certain statistics are unsupported and\nskipped during bcm_sysport_get_stats(). The variable 'j' tracks the\ncompacted index into the destination data buffer, whereas 'i' iterates\nover all elements in bcm_sysport_gstrings_stats.\n\nBecause the buffer allocated by ethtool is sized only according to\nbcm_sysport_get_sset_count(), storing values at data[i] instead of\ndata[j] writes past the allocated array bounds, leading to memory\ncorruption.\n\nFix this by writing to data[j] instead of data[i]."}], "id": "CVE-2026-98808", "lastModified": "2026-10-21T13:21:47.480", "metrics": {}, "published": "2026-10-18T16:17:34.893", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29d1d35ad5ad379a904263ea1cd4ba1d71cd965f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96a2b042051553df0d9f03b518dd3b7105b36935"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96d8b26be5bc451188acdcee055948da45adbde0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/faba9fdde480356f4a1d3b1a5713b7b354858a1c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats()", "id": "2555255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555255"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: systemport: Fix buffer overflow in bcm_sysport_get_stats()\nWhen running on SYSTEMPORT Lite, certain statistics are unsupported and\nskipped during bcm_sysport_get_stats(). The variable 'j' tracks the\ncompacted index into the destination data buffer, whereas 'i' iterates\nover all elements in bcm_sysport_gstrings_stats.\nBecause the buffer allocated by ethtool is sized only according to\nbcm_sysport_get_sset_count(), storing values at data[i] instead of\ndata[j] writes past the allocated array bounds, leading to memory\ncorruption.\nFix this by writing to data[j] instead of data[i].", "A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. Due to improper buffer indexing when handling unsupported statistics, the driver writes past the allocated array boundaries, resulting in a system crash."], "name": "CVE-2026-98808", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98808\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98808\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98808.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10377ba7673d19e28d92846955d51f49acd25c35,29d1d35ad5ad379a904263ea1cd4ba1d71cd965f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10377ba7673d19e28d92846955d51f49acd25c35,96d8b26be5bc451188acdcee055948da45adbde0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10377ba7673d19e28d92846955d51f49acd25c35,faba9fdde480356f4a1d3b1a5713b7b354858a1c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[10377ba7673d19e28d92846955d51f49acd25c35,eb7b84af0ec5c71b4920e999611b466b3784496c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:30:14.254375+00:00", "updated": "2026-10-24T03:30:15.424785+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}