{"id":"CVE-2026-98030","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 7318166cacad158b46240f66250d7cc5a481653b < ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < 8e41ce02589c92356bfd8ef62f6ceff840546e1a","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < f5e93162b3dd195bfda815e8f7a39aaf1d45437b","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < f1a2869b3629c0e8394b77b38cb9f19a018c653c","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < fd1a78c16b1f6978c09cf048e15f349732e4c707","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < b231b6d8516d3fe0d4bba549908e08d26a4531a5","Linux >= 7318166cacad158b46240f66250d7cc5a481653b < cdb719f4b8596d9ccee2d56d204c2c4dce982f46","Linux 4.11"],"published":"2026-09-25","updated":"2026-10-03","sourceUpdated":"2026-10-03T11:18:25.927","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98030","references":[{"url":"https://git.kernel.org/stable/c/8e41ce02589c92356bfd8ef62f6ceff840546e1a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ca49c526291d7cd3a5cb49b0edd7f50a5ae7176e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2cf4ef2d94fc15fd2e21c131fc1ab3f76125bf4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5e93162b3dd195bfda815e8f7a39aaf1d45437b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98030.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98030"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2541224"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98030"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98030"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98030.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00122,"epssPercentile":0.01934,"scores":{"nvd":7,"vendor":5.5,"cna":7},"ingestedAt":"2026-09-25T11:06:38.853Z","slug":"CVE-2026-98030","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98030.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210922,"id":"CVE-2026-98030","ts":1790349115916,"field":"cvss","old":null,"new":"7"},{"seq":210921,"id":"CVE-2026-98030","ts":1790349115916,"field":"severity","old":"none","new":"high"}]}