CVE-2026-97435 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: sja1105: flower: reject cross-chip redirect
dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count.
Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel networking subsystem contains a critical flaw within the DSA (Distributed Switch Architecture) driver for the SJA1105 Ethernet switch chip, specifically in its flower classification handling logic. This vulnerability arises from an insufficient validation of port identifiers when processing network traffic redirection rules. The core issue lies in the behavior of the dsa_port_from_netdev function, which is responsible for mapping a network device to a corresponding DSA port structure. Under certain conditions, this function may return a valid pointer that corresponds to a physical port on a different switch chip within the same multi-chip topology rather than the local hardware instance processing the request. This misidentification occurs because the function does not strictly enforce locality constraints relative to the current context of execution or the specific hardware device being configured.
When this incorrect port reference is utilized, it leads to severe operational consequences for network traffic management and system stability. The driver proceeds to program a port index that belongs to an external chip into the local switch's hardware registers. This action results in two distinct failure modes depending on the value of the provided index. If the foreign port index falls within the range of valid ports for the local chip, it causes unintended cross-chip redirection where traffic is sent to a completely different physical location than intended by the administrator or application logic. More critically, if the external port index exceeds the maximum number of ports supported by the local SJA1105 device, it triggers an out-of-bounds memory access within the driver's internal data structures or hardware configuration space. This can lead to kernel panics, system crashes, or potentially exploitable conditions where an attacker could manipulate network forwarding paths to bypass security controls or disrupt service availability.
From a vulnerability classification perspective, this flaw aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write depending on the specific implementation details of how the index is used during hardware programming. It also relates to CWE-693 Protection Mechanism Failure as the system fails to enforce boundary checks appropriate for multi-device environments. In terms of attack vectors, this vulnerability could be leveraged in scenarios where an attacker has the ability to configure traffic classification rules via netlink or similar interfaces, potentially allowing them to cause denial-of-service through kernel instability or manipulate network topology by redirecting packets across chip boundaries without authorization. The ATT&CK framework would categorize aspects of this under T1048 Exfiltration Over Alternative Protocol if used for covert data movement, though the primary impact here is availability and integrity compromise due to improper input validation.
The resolution implemented in the kernel addresses this issue by introducing a strict locality check within the flower classification code path. The fix ensures that any port index derived from a network device must belong to the same switch chip instance as the one currently handling the configuration request. If a cross-chip redirect is attempted, the operation is explicitly rejected with an appropriate extended acknowledgment message to inform userspace of the invalidity of the request. This minimal patch prevents the driver from programming incorrect hardware registers, thereby eliminating both the risk of out-of-bounds access and unintended traffic redirection. While the fix does not address the alternative behavior of redirecting such traffic to the upstream port for software-based forwarding when skip_sw is unset, it effectively closes the immediate security gap by enforcing strict device-locality constraints on all hardware-offloaded flow rules.
To mitigate this vulnerability in deployed systems, administrators should ensure that their Linux kernels are updated to include the patched version of the DSA SJA1105 driver. For environments where kernel updates are not immediately feasible, network segmentation and strict access controls on netlink interfaces can reduce the risk of exploitation by limiting which users or processes can modify traffic classification rules. Additionally, monitoring for unusual kernel logs related to DSA port mapping errors may help in detecting attempted exploits before they result in system instability. Regular auditing of network configuration scripts that interact with switch chips is also recommended to ensure compliance with expected topology constraints and prevent the submission of invalid cross-chip directives.