CVE-2026-98808 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats.
Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of
data[j] writes past the allocated array bounds, leading to memory
corruption.
Fix this by writing to data[j] instead of data[i].
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel network subsystem contains a critical buffer overflow vulnerability within the bcm_sysport_get_stats function in the systemport driver. This flaw specifically affects systems utilizing SYSTEMPORT Lite hardware, where certain statistical counters are unsupported and consequently skipped during the retrieval process. The root cause lies in an indexing error that occurs when populating the statistics data structure for user-space applications via ethtool. The function utilizes two distinct loop variables: 'i' serves as the iterator over all elements defined in bcm_sysport_gstrings_stats, while 'j' tracks the compacted index into the destination data buffer to account for skipped entries.
The operational impact of this vulnerability stems from a mismatch between the allocated memory size and the indexing strategy used during data population. The ethtool interface allocates a buffer sized strictly according to bcm_sysport_get_sset_count, which reflects only the supported statistics that will actually be returned. However, due to the bug, the code writes values using the index 'i', which continues to increment for every element in the source array regardless of whether it was skipped or not. This results in writing past the allocated array bounds whenever unsupported stats are encountered and skipped by decrementing 'j' but continuing to use 'i' as the write offset.
This out-of-bounds memory access leads directly to heap-based buffer overflow, causing severe memory corruption within the kernel space. Such corruption can destabilize the system, potentially leading to a denial of service through kernel panic or crash. In more sophisticated attack scenarios, an attacker with local network access could exploit this memory overwrite to achieve arbitrary code execution by overwriting adjacent kernel data structures or function pointers. The vulnerability is classified under CWE-120 Buffer Copy without Checking Size of Input and aligns with ATT&CK techniques related to privilege escalation via exploitation of software vulnerabilities in operating system services.
The resolution involves correcting the indexing logic within bcm_sysport_get_stats to ensure that writes occur exclusively at data[j] rather than data[i]. This adjustment ensures that the destination buffer is populated only up to its allocated limit, maintaining alignment between the number of supported statistics and the memory reserved for them. Administrators should apply kernel updates containing this patch immediately to mitigate the risk of local privilege escalation or system instability on affected systems running SYSTEMPORT Lite hardware.