{"id":"CVE-2026-98030","published":"2026-09-25T11:17:31.673","lastModified":"2026-09-25T15:18:04.627","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size\n\nbcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into\nrule_locs[] without consulting nfc->rule_cnt, which is how many entries\nthe caller had room for.  ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN\nand the ioctl sizes the buffer from the rule_cnt userspace passes in, so\nonce an admin has installed CFP rules any user can ask for fewer slots\nthan there are rules and run off the end of the allocation.  A rule_cnt\nof 0 leaves the buffer pointer NULL and the walk dereferences it.","cvssScore":7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5","tags":[]},{"url":"https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46","tags":[]},{"url":"https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c","tags":[]},{"url":"https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}