All vulnerabilities
CVE-2026-98028

Linux: eth: nfp: drop the replaced rule from the list when reprogramming fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in603b70093f729f52a37544b48679903cad834856Also 552e528a7d85cbe088b2ae4f78194713975b46cf, 108bb2142e3a12c9ad625ad662973127a113ddc6CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 603b70093f729f52a37544b48679903cad834856LinuxCVE List
  • 552e528a7d85cbe088b2ae4f78194713975b46cfLinuxCVE List
  • 108bb2142e3a12c9ad625ad662973127a113ddc6LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

eth: nfp: drop the replaced rule from the list when reprogramming fails

nfp_net_fs_add() replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count and programming the new one. If nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the success path reaches list_replace() - so the list is one longer than nn->fs.count, and it advertises a rule whose hardware entry has already been torn down.

nn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes its buffer one entry short of what the GRXCLSRLALL walk wants to write. That used to overwrite one u32 past the allocation; since the walk is bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the counter.

Text from CVE List

Affected versions 10

  • Linuxaffected: 9eb03bb1c035ff6e2c3a34046419446588253dda before 603b70093f729f52a37544b48679903cad834856CVE List
  • Linuxaffected: 9eb03bb1c035ff6e2c3a34046419446588253dda before edaec279f59f801a05b751df475ed71a0a68c88aCVE List
  • Linuxaffected: 9eb03bb1c035ff6e2c3a34046419446588253dda before 552e528a7d85cbe088b2ae4f78194713975b46cfCVE List
  • Linuxaffected: 9eb03bb1c035ff6e2c3a34046419446588253dda before 108bb2142e3a12c9ad625ad662973127a113ddc6CVE List
  • Linuxaffected: 6.8CVE List
  • Linuxunaffected: all versions before 6.8CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4