CVE-2026-98030

Executive Summary

CVE-2026-98030 is an out-of-bounds read in the Linux kernel's Broadcom SF2 (bcm_sf2) DSA switch driver. The function bcm_sf2_cfp_rule_get_all() walks the entire cfp.unique bitmap into rule_locs[] without honoring nfc->rule_cnt, the caller-supplied capacity, so any local unprivileged user can request ETHTOOL_GRXCLSRLALL with a small or zero slot count and force the kernel to write past the end of a caller-sized allocation. Impact is memory corruption / out-of-bounds read and write, kernel panic (DoS), and potential local information disclosure; the flaw is reachable without CAP_NET_ADMIN, which materially lowers the exploitation bar on affected switch platforms.

Technical Analysis

The affected component is the Broadcom SF2 switch driver within the Linux kernel's Distributed Switch Architecture (DSA) subsystem (net: dsa: bcm_sf2). The driver exposes hardware CFP (Compact Field Processor) rule management to userspace through the standard ethtool classifier interface. The relevant entry point is the ETHTOOL_GRXCLSRLALL ioctl, which retrieves all Rx classifier rules.

The defect is a bounded-write violation. bcm_sf2_cfp_rule_get_all() iterates over the whole cfp.unique bitmap and writes one entry per set bit into rule_locs[]. Critically, it never consults nfc->rule_cnt, which is the number of slots the caller allocated and passed in. ETHTOOL_GRXCLSRLALL is intentionally available without CAP_NET_ADMIN, and the ioctl layer sizes the destination buffer directly from the userspace-supplied rule_cnt. The result is a classic attacker-controlled-length versus kernel-populated-length mismatch:

• If rule_cnt is smaller than the number of installed CFP rules, the walk writes past the end of the allocation (heap out-of-bounds write).
• If rule_cnt is 0, the kernel sets the buffer pointer to NULL and the walk then dereferences that NULL pointer, producing an immediate kernel oops/panic.

Prerequisites are minimal but non-zero: at least one CFP rule must already have been installed by an administrator for the over-run path to have anything to write. The read of the cfp.unique bitmap continues regardless of the caller's capacity, so the loop termination condition is bound to hardware rule state rather than to the user buffer, which is the root cause. There is insufficient technical detail in the provided description to specify the exact structure layout of rule_locs[] entries, the bitmap width, or the precise assignment expression at fault; those are not asserted here.

This maps to CWE-125 (out-of-bounds read) with a secondary out-of-bounds write effect. No CVSS score or vector was published by the CNA and none is computed here from secondary sources.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-98030. The chain below is inferred strictly from the described flaw class and stated preconditions; no function names beyond those in the description are used.

1. Reconnaissance / target identification. The attacker must be able to execute code locally on a system running an affected Linux kernel where the bcm_sf2 DSA driver is bound and CFP offload is active. Such systems are typically embedded network devices (switches, routers, residential gateways) or appliances using Broadcom SF2-family switch silicon. The attacker also needs to establish that at least one CFP rule has been installed by an administrator, since the oversized-walk path depends on existing rules in cfp.unique; this can often be inferred from device role or from the success/failure behavior of the query itself.

2. Triggering the flaw class. The attacker issues the ETHTOOL_GRXCLSRLALL ioctl, which requires no CAP_NET_ADMIN. In the request they supply a rule_cnt deliberately smaller than the number of rules actually present in cfp.unique — or rule_cnt of 0. The driver-accepted buffer is sized to the user's number, while bcm_sf2_cfp_rule_get_all() walks the entire bitmap into rule_locs[].

3. Payload / execution method (vulnerability-class level). This is not a code-injection primitive by itself. The primary effect is an out-of-bounds write into an undersized kernel allocation (memory corruption) or, at rule_cnt of 0, a NULL-pointer dereference in kernel context. Exploitation-at-class for OOB write would follow the usual kernel heap-grooming pattern: repeatedly issue the ioctl with tuned sizes to shape adjacent slab objects, then attempt to corrupt an adjacent object to gain control of a kernel pointer. At rule_cnt of 0 the effect is deterministic denial of service (kernel oops/panic). No specific allocation sizes, structure fields, or spray primitives are asserted because the description does not provide them.

4. Post-exploitation impact. Realistic outcomes, in order of confidence: (a) kernel oops/panic causing device reset or denial of service; (b) kernel memory disclosure via the out-of-bounds read of adjacent allocation contents returned to the caller through the ethtool reply buffer; (c) in the strongest case, local privilege escalation by converting the OOB write into control of a kernel object — plausible for a local OOB write class but unproven here absent PoC evidence.

Impact Assessment

Affected systems are those running an affected Linux kernel with the bcm_sf2 DSA driver loaded and the impacted hardware present. Because the bug lives in a hardware-specific switch driver, exposure is concentrated in embedded networking gear rather than general-purpose servers — but that population includes edge routers, managed switches, and CPE that often carry high-value positions in the network. The lack of a CAP_NET_ADMIN requirement is the key risk multiplier: any local user, or any application that can be induced to run code on the device, becomes a candidate attacker. Blast radius depends on how the kernel handles the over-write: at minimum a full-device denial of service from a kernel panic; at worst, local privilege escalation, which on an embedded switch/gateway converts a low-privilege foothold into full control of the device and its traffic paths. An additional information-disclosure risk follows from the out-of-bounds read. No CVSS score or vector was published for this CVE and none is asserted.

Detection Guidance

Sigma Rule

title: Local Attempt to Trigger bcm_sf2 CFP Rule Dump Out-of-Bounds (CVE-2026-98030)
id: 7f2c1e4a-9c3b-4d8e-b1a2-5e6f0c9d2a11
status: experimental
description: Detects local execution of tooling that issues ETHTOOL_GRXCLSRLALL with a mismatched rule_cnt against the bcm_sf2 DSA driver. Expected detection surface is kernel oops/panic telemetry.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98030
author: valtersit.com
logsource:
  product: linux
  service: kernel
detection:
  selection_panic:
    message|contains:
      - 'bcm_sf2_cfp_rule_get_all'
      - 'BUG: kernel NULL pointer dereference'
      - 'unable to handle kernel NULL pointer dereference'
  selection_oob:
    message|contains:
      - 'slab-out-of-bounds'
      - 'KASAN: slab-out-of-bounds'
  condition: selection_panic or selection_oob
falsepositives:
  - Unrelated kernel bugs producing slab-out-of-bounds messages on bcm_sf2 platforms
level: high

YARA Rule

rule CVE_2026_98030_bcm_sf2_cfp_dump
{
    meta:
        description = "Detects kernel images/objects exposing the bcm_sf2 CFP rule dump symbol associated with CVE-2026-98030"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98030"
        cve = "CVE-2026-98030"

    strings:
        $sym1 = "bcm_sf2_cfp_rule_get_all" ascii
        $sym2 = "cfp.unique" ascii
        $drv  = "bcm_sf2" ascii

    condition:
        uint32be(0) == 0x464c457f and $drv and any of ($sym*)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"LOCAL CVE-2026-98030 bcm_sf2 CFP rule dump exploitation - ethtool GRXCLSRLALL"; flow:to_server; content:"|00 00|"; depth:1; classtype:attempted-admin; sid:202698030; rev:1;)

Note: this ioctl does not traverse the network, so network-based detection has limited fidelity; accompanying host telemetry is the authoritative source.

Elastic Detection

process where event.type == "start" and process.name in ("ethtool", "ip", "busybox") and process.command_line like~ "*rxclsrlall*"

Supplementary kernel-event detection:

logs-linux.kernel where message like "bcm_sf2_cfp_rule_get_all" or message like "KASAN: slab-out-of-bounds"

Splunk SPL Query

index=linux host=* sourcetype=syslog ("bcm_sf2_cfp_rule_get_all" OR "unable to handle kernel NULL pointer dereference" OR "KASAN: slab-out-of-bounds" OR "BUG: kernel NULL pointer dereference")
| stats count, values(_raw) by host
| where count > 0

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-98030">
  <rule id="2026980" level="12">
    <decoded_as>syslog</decoded_as>
    <match>bcm_sf2_cfp_rule_get_all</match>
    <description>CVE-2026-98030: Possible bcm_sf2 CFP rule dump out-of-bounds trigger / kernel fault</description>
  </rule>
  <rule id="2026981" level="12">
    <decoded_as>syslog</decoded_as>
    <match>KASAN: slab-out-of-bounds</match>
    <description>CVE-2026-98030: Kernel slab-out-of-bounds possibly related to bcm_sf2 CFP dump</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict local access to affected devices as tightly as possible — the bug requires local execution and, for the over-run path, at least one pre-existing CFP rule. Where operationally feasible, avoid installing CFP classifier rules via ethtool on affected hardware, since that is the precondition for the out-of-bounds write; with no rules installed, an attacker's rule_cnt mismatch still hits the NULL-pointer path at rule_cnt of 0 but cannot overflow a rule-sized allocation. Reduce the number of low-privilege accounts and constrain execution of user-supplied code on embedded switch/gateway platforms. Monitor kernel logs for the fault signatures used in the detections above.

2. Patch / upgrade steps. No patched version is available from tracked sources at the time of writing. Treat the device as vulnerable until the Linux kernel net/net-next stable trees publish a commit that bounds bcm_sf2_cfp_rule_get_all() by nfc->rule_cnt (and rejects or short-circuits rule_cnt of 0). When available, apply the vendor's firmware or kernel update and verify the kernel version against the stable release notes. Until then, do not assume a version is fixed.

3. Long-term hardening. Enable Kernel Address Sanitizer (KASAN) and hardened memory allocation on development images to catch sibling bugs of this class; deploy kernel fault telemetry centrally so oops/panic events from edge devices are aggregated and alerted on rather than lost. Apply least privilege aggressively on embedded network devices, and audit which ethtool/classifier operations are reachable by unprivileged users. Track upstream Linux net stable advisories for the bcm_sf2 driver and re-evaluate exposure when the fix is released.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-98030
• Linux Kernel Mailing List / netdev and stable tree advisories — https://lore.kernel.org/netdev/ and https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
• Kernel Self-Protection Project (KASAN, mitigation guidance) — https://kspp.github.io/
• CWE-125 Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• No public PoC or exploit code was identified for this CVE; CISA KEV does not list it. No threat-actor campaign or in-the-wild exploitation evidence was identified in the data provided.