CVE-2026-98808

CVE-2026-98808

published October 18, 2026

CVSS
—
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

When running on SYSTEMPORT Lite, certain statistics are unsupported and

skipped during bcm_sysport_get_stats(). The variable 'j' tracks the

compacted index into the destination data buffer, whereas 'i' iterates

over all elements in bcm_sysport_gstrings_stats.

Because the buffer allocated by ethtool is sized only according to

bcm_sysport_get_sset_count(), storing values at data[i] instead of

data[j] writes past the allocated array bounds, leading to memory

corruption.

Fix this by writing to data[j] instead of data[i].

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.6th percentile
Published
2026-10-18T20:17Z
References (5)
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 18 OCT 15:48Z
    net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
    cvelistv5
  • 18 OCT 15:48Z
    net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
    cvelistv5