rootpwn

high · CVSS v3 7

CVE-2026-98027

A Linux kernel bug in the Marvell mv88e6xxx DSA driver allows any user to trigger a buffer overflow via the ETHTOOL_GRXCLSRLALL ioctl, poten

Overview

A Linux kernel bug in the Marvell mv88e6xxx DSA driver allows any user to trigger a buffer overflow via the ETHTOOL_GRXCLSRLALL ioctl, potentially corrupting kernel memory. The flaw occurs when the driver incorrectly uses the caller‑supplied rule count as a write index, leading to out‑of‑bounds access. This can enable privilege escalation or denial of service on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input is the number of entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed policy rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it. Count into a local so the caller's limit survives the walk, and stop with -EMSGSIZE once it is reached.

Impact

The vulnerability can compromise confidentiality, integrity, and availability of the host. An attacker may gain root privileges or crash the kernel, disrupting services. Systems with the mv88e6xxx driver loaded and ETHTOOL access are at risk.

Remediation

Apply the vendor‑supplied kernel patch that bounds the policy rule dump correctly. If patching is delayed, disable the mv88e6xxx driver or block ETHTOOL_GRXCLSRLALL via SELinux/AppArmor or sysctl. Ensure the system runs a kernel version that includes the fix and enable kernel hardening options such as CONFIG_STRICT_DEVMEM.

Risk context

Severity is high with a CVSS v3 score of 7.0. While no EPSS data is available, the flaw permits kernel memory corruption without privilege checks, warranting prompt patching or mitigation.

Affected products

  • Linux kernel
  • Marvell 88E6xxx DSA driver
  • mv88e6xxx
  • Linux networking stack

Scores

Severity
high
CVSS v2
6
CVSS v3
7
CVSS v4
—
EPSS
—

kernel buffer-overflow privilege-escalation network-driver mv88e6xxx dsa ethtool

← All CVEs

Related CVEs

high

CVE-2026-98026

This vulnerability affects the Linux kernel's bridge multicast handling. An improper RCU usage can lead to premature freeing of port group structures, potentially causing memory corruption or crashes. The fix converts mglist to RCU and corrects initialization order.

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis