SB20260928169 - Out-of-bounds write in Linux kernel netronome nfp driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98029)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption or a denial of service.

The vulnerability exists due to missing bounds checking in nfp_net_get_fs_loc() when handling ETHTOOL_GRXCLSRLALL requests with a user-supplied rule count smaller than the number of flow steering rules. A local user can issue a crafted ioctl request to write rule locations beyond the caller-provided buffer.

Exploitation requires flow steering rules to have been installed; a rule count of zero leaves the rule-locations pointer NULL.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/82812583b9c69c241da6da4186f14e9df2516488
• https://git.kernel.org/stable/c/a7e023c63e855761c1426cee8d17c2bca32aa339
• https://git.kernel.org/stable/c/ecebfdaab72a504c10f4907bd00fc3b705ec3b12
• https://git.kernel.org/stable/c/f1986bf87b0709c95126fe196cf39e5b8c8453a1