CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails
In the Linux kernel, the following vulnerability has been resolved:
eth: nfp: drop the replaced rule from the list when reprogramming fails
nfpnetfsadd() replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count and programming the new one. If nfpnetfsaddhw() fails the old entry stays on nn->fs.list - only the success path reaches listreplace() - so the list is one longer than nn->fs.count, and it advertises a rule whose hardware entry has already been torn down.
nn->fs.count is what ETHTOOLGRXCLSRLCNT reports, so userspace then sizes its buffer one entry short of what the GRXCLSRLALL walk wants to write. That used to overwrite one u32 past the allocation; since the walk is bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the counter.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the inconsistent rule state?
An existing rule must be replaced, its hardware entry must be deleted, and programming the replacement through nfp_net_fs_add_hw() must then fail. This leaves the old rule on the software list even though its hardware entry has been removed.
How can an administrator recognize an affected state?
The ethtool ETHTOOL_GRXCLSRLCNT count can be one lower than the number of entries traversed by ETHTOOL_GRXCLSRLALL. Requests to retrieve all rules can then permanently fail with -EMSGSIZE because the counter is not resynchronized.
What is the practical impact after the inconsistency occurs?
Userspace may allocate space for one fewer rule than the all-rules query attempts to return. The bounded walk prevents the prior one-u32 overwrite behavior, but the rules query remains stuck returning -EMSGSIZE until the state is corrected.