CVE-2026-98027: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
mv88e6xxxgetrxnfc() uses rxnfc->rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input is the number of entries the caller had room for. ETHTOOLGRXCLSRLALL requires no CAPNETADMIN and the ioctl sizes the buffer from the rulecnt userspace passes in, so once an admin has installed policy rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rulecnt of 0 leaves the buffer pointer NULL and the walk dereferences it.
Count into a local so the caller's limit survives the walk, and stop with -EMSGSIZE once it is reached.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
Any local user can trigger it through ETHTOOL_GRXCLSRLALL; CAP_NET_ADMIN is not required. The issue becomes reachable after an administrator has installed policy rules on an affected mv88e6xxx DSA switch.
What input causes the out-of-bounds access?
A caller can request fewer rule slots than the number of installed policy rules, causing the kernel to write past the ioctl buffer allocation. Supplying rule_cnt of 0 leaves the buffer pointer NULL and can cause it to be dereferenced.
What behavior does the fix introduce for undersized caller buffers?
The fixed code preserves the caller-provided rule limit while counting policy rules. It stops and returns -EMSGSIZE when that limit is reached, rather than continuing to write entries.