CVE-2026-97435: net: dsa: sja1105: flower: reject cross-chip redirect
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: sja1105: flower: reject cross-chip redirect
dsaportfromnetdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count.
Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skipsw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a check in the Linux kernel DSA SJA1105 flower handling to reject cross-chip redirects, preventing a port index from another switch from being programmed into the local hardware.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the Linux kernel's SJA1105 DSA flower offload are affected when a redirect rule selects a valid DSA port that belongs to a different switch chip than the local hardware being programmed.
What is the impact of a cross-chip redirect rule?
The local switch can be programmed with another chip's port index, causing traffic to be redirected to the wrong port. If that index is larger than the local chip's port count, it can result in an out-of-bounds access.