CVE-2026-98028

Overview

CVE-2026-98028 is a high‑severity bug in the Linux kernel’s NFP (Netronome Flow Processor) driver that causes a mismatch between the rule count reported to userspace and the actual list of rules. This leads to ETHTOOL commands receiving an incorrect buffer size, resulting in a permanent -EMSGSIZE error and a denial of service for network configuration operations. The flaw is triggered when reprogramming a rule fails and the old entry is not removed from the list.

Description

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfp_net_fs_add() replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count and programming the new one. If nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the success path reaches list_replace() - so the list is one longer than nn->fs.count, and it advertises a rule whose hardware entry has already been torn down. nn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes its buffer one entry short of what the GRXCLSRLALL walk wants to write. That used to overwrite one u32 past the allocation; since the walk is bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the counter.

Impact

The vulnerability primarily impacts availability by causing ETHTOOL operations to fail, potentially disrupting network configuration and management. Network administrators and systems utilizing NFP hardware are directly affected, as the error can prevent proper rule updates and degrade network stability.

Remediation

Apply the kernel patch that corrects the nfp_net_fs_add_hw failure path to properly update the rule list and counter. If immediate patching is not possible, disable the NFP driver or avoid using ETHTOOL commands that modify flow rules until the fix is applied.

Risk context

Severity is high with a CVSS v3 score of 7.1. No EPSS data is available, but the issue can cause a denial of service for network configuration, warranting prompt attention.

Affected products

• Netronome NFP
• Linux kernel
• nfp driver
• Netronome Flow Processor
• nfp_net_fs_add
• nfp_net_fs_add_hw