Strix
73.3K

CVE-2026-98808

UnknownEPSS 0.19%

Last modified

CVE-2026-98808 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].. EPSS estimates a 0.19% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].

Metrics

EPSS Probability
0.19%

8.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 10377ba7673d19e28d92846955d51f49acd25c35, < 96a2b042051553df0d9f03b518dd3b7105b36935; >= 10377ba7673d19e28d92846955d51f49acd25c35, < 29d1d35ad5ad379a904263ea1cd4ba1d71cd965f; >= 10377ba7673d19e28d92846955d51f49acd25c35, < 96d8b26be5bc451188acdcee055948da45adbde0; >= 10377ba7673d19e28d92846955d51f49acd25c35, < faba9fdde480356f4a1d3b1a5713b7b354858a1c; >= 10377ba7673d19e28d92846955d51f49acd25c35, < eb7b84af0ec5c71b4920e999611b466b3784496c
LinuxLinux4.14

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98808?
In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].
How severe is CVE-2026-98808?
Severity scoring for CVE-2026-98808 is pending analysis. The EPSS model estimates a 0.19% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98808?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98808?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST