CVE-2026-98028

In the Linux kernel, the following vulnerability has been resolved:

eth: nfp: drop the replaced rule from the list when reprogramming fails

nfp net fs add() replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count and programming the new one. If nfp net fs add hw() fails the old entry stays on nn->fs.list - only the success path reaches list replace() - so the list is one longer than nn->fs.count, and it advertises a rule whose hardware entry has already been torn down.

nn->fs.count is what ETHTOOL GRXCLSRLCNT reports, so userspace then sizes its buffer one entry short of what the GRXCLSRLALL walk wants to write. That used to overwrite one u32 past the allocation; since the walk is bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the counter.