Buffer Overflow in Linux Kernel's Network Flow Steering Component

CVE-2026-98029

What is CVE-2026-98029?

A vulnerability in the Linux Kernel's network flow steering mechanism allows for potential buffer overflow threats. Specifically, the function nfp_net_get_fs_loc() fails to appropriately respect the buffer size provided by the caller when dumping entries from nn->fs.list into rule_locs[]. This oversight allows an attacker with user privileges to exploit the system by requesting fewer slots than the number of existing flow steering rules, leading to an out-of-bounds read. The issue can be exploited when the buffer's rule count is set to zero, causing a NULL pointer dereference. This vulnerability is addressed by ensuring that the buffer allocation checks are performed adequately, returning an error when the buffer reaches capacity and effectively preventing stale data from being read.

References