CVE-2026-98030

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bcm sf2 cfp rule get all() function where the cfp.unique bitmap is processed into rule locs[] without verifying the nfc->rule cnt variable, which defines the available buffer space provided by the caller. Because the ETHTOOL GRXCLSRLALL ioctl does not require CAP NET ADMIN privileges and determines buffer size based on the rule cnt passed from userspace, a user can request fewer slots than the actual number of installed rules, leading to a buffer overflow. Additionally, if rule cnt is set to 0, the buffer pointer becomes NULL, resulting in a null pointer dereference during the process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.