SB20260928167 - Out-of-bounds write in Linux kernel dsa mv88e6xxx driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98027)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or compromise confidentiality and integrity.

The vulnerability exists due to an out-of-bounds write in the mv88e6xxx_get_rxnfc() policy rule dump handler when processing an ETHTOOL_GRXCLSRLALL request with fewer caller-provided slots than policy rules. A local user can issue a request specifying an insufficient rule count to write beyond the allocated buffer.

Exploitation requires policy rules to have been installed for the targeted port.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070
• https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b
• https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5
• https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739