SB20260928170 - Out-of-bounds write in Linux kernel net dsa driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98030)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an out-of-bounds write in bcm_sf2_cfp_rule_get_all() in the Broadcom Starfighter 2 DSA driver when processing ETHTOOL_GRXCLSRLALL ioctl requests with a caller-supplied rule count. A local user can request fewer rule slots than installed CFP rules to compromise confidentiality, integrity, and availability.

Exploitation requires CFP rules to have already been installed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/b231b6d8516d3fe0d4bba549908e08d26a4531a5
• https://git.kernel.org/stable/c/cdb719f4b8596d9ccee2d56d204c2c4dce982f46
• https://git.kernel.org/stable/c/f1a2869b3629c0e8394b77b38cb9f19a018c653c
• https://git.kernel.org/stable/c/fd1a78c16b1f6978c09cf048e15f349732e4c707