CVE-2026-98028

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: nfp: drop the replaced rule from the list when reprogramming fails

nfp_net_fs_add() replaces an existing rule by deleting it from the

hardware, decrementing nn->fs.count and programming the new one. If

nfp_net_fs_add_hw() fails the old entry stays on nn->fs.list - only the

success path reaches list_replace() - so the list is one longer than

nn->fs.count, and it advertises a rule whose hardware entry has already

been torn down.

nn->fs.count is what ETHTOOL_GRXCLSRLCNT reports, so userspace then sizes

its buffer one entry short of what the GRXCLSRLALL walk wants to write.

That used to overwrite one u32 past the allocation; since the walk is

bounded it is a permanent -EMSGSIZE instead, as nothing ever resyncs the

counter.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References