« Volver al listado

CVE-2026-98028

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

eth: nfp: drop the replaced rule from the list when reprogramming fails

nfp_net_fs_add() replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count and programming the new one. If nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the success path reaches list_replace() - so the list is one longer than nn->fs.count, and it advertises a rule whose hardware entry has already been torn down.

nn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes its buffer one entry short of what the GRXCLSRLALL walk wants to write.

Leer descripción completaMostrar menos

That used to overwrite one u32 past the allocation; since the walk is bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the counter.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98028",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9eb03bb1c035ff6e2c3a34046419446588253dda",
              "lessThan": "603b70093f729f52a37544b48679903cad834856",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9eb03bb1c035ff6e2c3a34046419446588253dda",
              "lessThan": "edaec279f59f801a05b751df475ed71a0a68c88a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9eb03bb1c035ff6e2c3a34046419446588253dda",
              "lessThan": "552e528a7d85cbe088b2ae4f78194713975b46cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9eb03bb1c035ff6e2c3a34046419446588253dda",
              "lessThan": "108bb2142e3a12c9ad625ad662973127a113ddc6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:31.447",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/108bb2142e3a12c9ad625ad662973127a113ddc6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/552e528a7d85cbe088b2ae4f78194713975b46cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/603b70093f729f52a37544b48679903cad834856",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/edaec279f59f801a05b751df475ed71a0a68c88a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: nfp: drop the replaced rule from the list when reprogramming fails\n\nnfp_net_fs_add() replaces an existing rule by deleting it from the\nhardware, decrementing nn->fs.count and programming the new one.  If\nnfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the\nsuccess path reaches list_replace() - so the list is one longer than\nnn->fs.count, and it advertises a rule whose hardware entry has already\nbeen torn down.\n\nnn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes\nits buffer one entry short of what the GRXCLSRLALL walk wants to write.\nThat used to overwrite one u32 past the allocation; since the walk is\nbounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the\ncounter."
    }
  ],
  "lastModified": "2026-09-25T11:17:31.447",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}