{"id":"CVE-2026-98808","title":"kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)","summary":"A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-787","vendor":"Red Hat","product":"Linux","affected":["Linux >= 10377ba7673d19e28d92846955d51f49acd25c35 < 96a2b042051553df0d9f03b518dd3b7105b36935","Linux >= 10377ba7673d19e28d92846955d51f49acd25c35 < 29d1d35ad5ad379a904263ea1cd4ba1d71cd965f","Linux >= 10377ba7673d19e28d92846955d51f49acd25c35 < 96d8b26be5bc451188acdcee055948da45adbde0","Linux >= 10377ba7673d19e28d92846955d51f49acd25c35 < faba9fdde480356f4a1d3b1a5713b7b354858a1c","Linux >= 10377ba7673d19e28d92846955d51f49acd25c35 < eb7b84af0ec5c71b4920e999611b466b3784496c","Linux 4.14"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:24:27+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98808.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98808.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98808"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555255"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98808"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98808"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98808.mbox"},{"url":"https://git.kernel.org/stable/c/96a2b042051553df0d9f03b518dd3b7105b36935"},{"url":"https://git.kernel.org/stable/c/29d1d35ad5ad379a904263ea1cd4ba1d71cd965f"},{"url":"https://git.kernel.org/stable/c/96d8b26be5bc451188acdcee055948da45adbde0"},{"url":"https://git.kernel.org/stable/c/faba9fdde480356f4a1d3b1a5713b7b354858a1c"},{"url":"https://git.kernel.org/stable/c/eb7b84af0ec5c71b4920e999611b466b3784496c"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00193,"epssPercentile":0.08942,"ingestedAt":"2026-10-18T16:47:32.479Z","slug":"CVE-2026-98808","body":"## Overview\n\nA flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. Due to improper buffer indexing when handling unsupported statistics, the driver writes past the allocated array boundaries, resulting in a system crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98808.json)\n\n**kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats()** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228693,"id":"CVE-2026-98808","ts":1792844909051,"field":"cvss","old":null,"new":"6.7"},{"seq":228692,"id":"CVE-2026-98808","ts":1792844909051,"field":"severity","old":"none","new":"medium"}]}