What’s Vulnerable › Vulnerabilities

CVE-2026-98027: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input is the number of entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed policy rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it. Count into a local so the caller's limit survives the walk, and stop with -EMSGSIZE once it is reached.

Affected products

• Linux kernel: 5.4 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3
• https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070
• https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f
• https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b
• https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887
• https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5
• https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a
• https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739

Get alerted when CVE-2026-98027 or the next vulnerability affects your stack