{"id":"CVE-2026-98027","summary":"net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc-\u003erule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at.  That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation.  A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached.","modified":"2026-09-26T03:48:31.447816573Z","published":"2026-09-25T10:23:45.123Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98027.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98027.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98027"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"da7dc87553046a43be1620a783ce3d9f6583d322"},{"fixed":"44cd4674d9aa5bdf793b8a8b481c9e8536ed6070"},{"fixed":"7a683c2b062810bca203e41866389daf387c235b"},{"fixed":"cda5ac8fe8ac8e80b1703ebb8c4250726fc19739"},{"fixed":"b1fffc273112e7284c5b705e186b43b5770cd3d5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98027.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98027.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}