CVE-2026-98808: net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
In the Linux kernel, the following vulnerability has been resolved:
net: systemport: Fix buffer overflow in bcmsysportgetstats()
When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcmsysportgstringsstats.
Because the buffer allocated by ethtool is sized only according to bcmsysportgetssetcount(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption.
Fix this by writing to data[j] instead of data[i].
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue occurs when the bcm_sysport driver runs on SYSTEMPORT Lite, where certain statistics are unsupported and skipped during statistics collection. The vulnerable path is bcm_sysport_get_stats().
What happens when the affected statistics path is used?
The driver can write statistics using the iterator index rather than the compacted destination-buffer index. Because the ethtool-allocated buffer is sized for the supported statistic count, this can write beyond the buffer bounds and cause memory corruption.