CVE-2026-98808: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98808 Overview

CVE-2026-98808 is a buffer overflow vulnerability in the Linux kernel's Broadcom SYSTEMPORT Ethernet driver (net/systemport). The flaw resides in bcm_sysport_get_stats() when running on SYSTEMPORT Lite hardware, where certain statistics are unsupported and skipped during enumeration. The function writes statistics values past the bounds of the ethtool-allocated destination buffer, causing kernel memory corruption. The Linux kernel maintainers have resolved the issue through upstream commits.

Critical Impact
Local kernel memory corruption triggerable by querying ethtool statistics on affected SYSTEMPORT Lite interfaces, potentially leading to kernel instability or privilege escalation.

Affected Products

Linux kernel versions containing the bcm_sysport driver prior to the fix
Systems using Broadcom SYSTEMPORT Lite Ethernet controllers
Downstream Linux distributions shipping affected stable kernel branches

Discovery Timeline

2026-10-18 - CVE-2026-98808 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98808

Vulnerability Analysis

The Broadcom SYSTEMPORT network driver exposes statistics to userspace via the ethtool interface. The bcm_sysport_get_stats() function iterates over the bcm_sysport_gstrings_stats array using index i, while a secondary index j tracks the compacted position inside the destination buffer. On SYSTEMPORT Lite hardware, some statistic entries are unsupported and skipped.

The destination buffer allocated by ethtool is sized according to the value returned by bcm_sysport_get_sset_count(), which reflects only the supported statistics. Writing results at data[i] instead of data[j] causes the driver to store values beyond the allocated length. This produces an out-of-bounds write in kernel memory [CWE-787].

Root Cause

The root cause is an index mismatch between the iteration counter i over all possible statistics and the compacted write counter j. When a statistic is skipped on SYSTEMPORT Lite, i continues to advance while j does not. Using i as the write offset into a buffer sized for the compacted set guarantees writes past the array bounds. The fix changes the assignment target to data[j].

Attack Vector

Triggering the overflow requires invoking ethtool -S or an equivalent ETHTOOL_GSTATS ioctl against a SYSTEMPORT Lite interface. On most systems this call is reachable by root or users with CAP_NET_ADMIN. The overflow writes attacker-influenced counter values into adjacent kernel heap memory, risking kernel panics, data corruption, or exploitation chains leading to local privilege escalation. The vulnerability is not remotely exploitable.

No public exploitation code examples are available. Refer to the upstream patches for implementation details.

Detection Methods for CVE-2026-98808

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN: slab-out-of-bounds reports in dmesg referencing bcm_sysport_get_stats
Kernel log entries showing SLUB corruption or redzone overwrite warnings near network statistics collection
Unexplained crashes on devices equipped with Broadcom SYSTEMPORT Lite interfaces following ethtool queries

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch out-of-bounds writes during ethtool statistics calls
Audit running kernel versions against the fixed commits (29d1d35, 96a2b042, 96d8b26, eb7b84af, faba9fdd) using package inventory tooling
Inspect kernel crash dumps for stack frames containing bcm_sysport_get_stats or ethtool_get_stats

Monitoring Recommendations

Forward kernel logs to a central logging platform and alert on crash signatures referencing the bcm_sysport driver
Monitor execution of ethtool -S against SYSTEMPORT interfaces by non-administrative processes
Track kernel package versions across the fleet and flag hosts running pre-patch builds on Broadcom-based hardware

How to Mitigate CVE-2026-98808

Immediate Actions Required

Apply the upstream Linux kernel patches that change the write index from data[i] to data[j] in bcm_sysport_get_stats()
Update to a vendor-supplied kernel package that includes one of the referenced stable commits
Reboot affected systems after kernel updates to load the fixed driver

Patch Information

The fix is available in the mainline and stable Linux kernel trees via the following commits: Kernel Commit 29d1d35, Kernel Commit 96a2b042, Kernel Commit 96d8b26, Kernel Commit eb7b84af, and Kernel Commit faba9fdd. Distribution maintainers backport these commits to supported stable branches.

Workarounds

Restrict access to ethtool and the ETHTOOL_GSTATS ioctl by limiting CAP_NET_ADMIN to trusted administrators
Avoid running statistics collection tooling against SYSTEMPORT Lite interfaces until kernels are patched
Where feasible, unbind or disable the bcm_sysport driver on devices that do not require it

bash

# Verify the running kernel contains the fix for CVE-2026-98808
uname -r
# Check installed kernel package version against the vendor advisory
# Example (Debian/Ubuntu):
dpkg -l | grep linux-image
# Example (RHEL/Fedora):
rpm -q kernel