CVE-2026-98029

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the nfp driver where the nfp net get fs loc() function dumps every entry of nn->fs.list into the rule locs[] buffer without verifying the cmd->rule cnt variable, which defines the buffer size provided by the caller. Because the ETHTOOL GRXCLSRLALL ioctl does not require CAP NET ADMIN privileges, any user can request fewer slots than the number of existing flow steering rules, leading to a buffer overflow. Additionally, if rule cnt is set to 0, the buffer pointer becomes NULL, and the subsequent walk operation causes a null pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.