Buffer Overflow in Linux Kernel Affects Broadcom Switch Chips

CVE-2026-98030

What is CVE-2026-98030?

A vulnerability has been identified in the Linux kernel where improper handling of the CFP rule dump can lead to a buffer overflow. The function bcm_sf2_cfp_rule_get_all() processes the entire cfp.unique bitmap into rule_locs[], without considering the actual number of entries that the caller's buffer can accommodate. This oversight allows a non-privileged user to exploit the situation by querying for fewer slots than the number of installed CFP rules. Consequently, this can lead to a dereference of a NULL pointer if rule_cnt is specified as 0, thereby creating a potential avenue for an attacker to compromise system stability and security.

References