Memory corruption in Linux kernel - CVE-2026-98272

Vulnerability details

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to a buffer overflow in the mvpp2 driver's page_pool array during mvpp2_bm_init() when changing the network interface MTU triggers a switch to per-CPU buffering without checking the pool count. A local user can trigger this buffering switch with a receive-queue configuration that exceeds the array capacity to corrupt memory.

The per-CPU buffering scheme requires two pools per receive queue and supports a maximum of eight pools.

Affected software

How to mitigate CVE-2026-98272

External References

• https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2
• https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a
• https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545
• https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c
• https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0
• https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c
• https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384
• https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8

Related Security Bulletins

• Memory corruption in Linux kernel marvell mvpp2 driver
• Debian update for linux