HIGH Introduced in 4.11
dsa CFPRule OOB
CVE-2026-98030
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.4HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size bcm_sf2_cfp_rule_get_all() walks the whole cfp.unique bitmap into rule_locs[] without consulting nfc->rule_cnt, which is how many entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed CFP rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
02KernelScan AI Analysis
Risk summary
Any local user on a system with a Broadcom SF2 switch driver loaded and pre-installed classification rules can trigger a kernel heap buffer overflow through the ethtool interface without special privileges. The overflow can corrupt kernel memory, potentially enabling privilege escalation or a system crash.
Vulnerability analysis
The Broadcom SF2 switch driver's flow classification rule dump walks all installed rules and writes their locations into a caller-provided buffer without checking how many entries the buffer can actually hold. An unprivileged local user can invoke the ethtool rule-list ioctl with a buffer smaller than the number of installed rules, causing the driver to write past the end of the kernel heap allocation; passing a buffer size of zero causes a NULL pointer dereference. The fix adds a bounds check that stops the dump and returns an error once the caller's buffer capacity is reached, which also prevents the NULL dereference. This requires the Broadcom SF2 switch driver to be loaded and for an administrator to have previously installed classification rules.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.11 | 5.10.271 | ca49c526291d |
| 5.15 | 4.11 | 5.15.222 | 8e41ce02589c |
| 6.1 | 4.11 | 6.1.189 | f2cf4ef2d94f |
| 6.6 | 4.11 | 6.6.158 | f5e93162b3dd |
| 6.12 | 4.11 | 6.12.111 | f1a2869b3629 |
| 6.18 | 4.11 | 6.18.53 | fd1a78c16b1f |
| 7.2 | 4.11 | 7.2.7 | b231b6d8516d |
| mainline | 4.11 | 7.3-rc3 | cdb719f4b859 |
| cip/6.12 | 4.11 | 6.12.111-cip32 | f1a2869b3629 |