CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98030 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98030

The Linux kernel contains a vulnerability in the net: dsa: bcm_sf2 component where the bcm_sf2_cfp_rule_get_all() function fails to check the caller's buffer size (nfc->rule_cnt) when walking the cfp.unique bitmap into rule_locs[]. Because the ETHTOOL_GRXCLSRLALL ioctl does not require CAP_NET...

CVE-2026-98029

The Linux kernel contains a vulnerability in the nfp driver where the nfp_net_get_fs_loc() function fails to check the cmd->rule_cnt when dumping entries into the rule_locs[] buffer. Because ETHTOOL_GRXCLSRLALL does not require CAP_NET_ADMIN privileges and uses a user-supplied rule_cnt to size...

CVE-2026-98029 eth: nfp: bound the ntuple rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

EUVD-2026-86683

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

EUVD-2026-86682

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

EUVD-2026-86680

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98027

The Linux kernel contains a vulnerability in the net: dsa: mv88e6xxx driver. The mv88e6xxx_get_rxnfc() function incorrectly uses rxnfc->rule_cnt as a write index while dumping the policy IDR, which clobbers the input value representing the caller's buffer size. Because ETHTOOL_GRXCLSRLALL does...

CVE-2026-98027 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

openSUSE Security Update : kernel (openSUSE-SU-2011:0004-1)

The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2010-4347: A local user could inject ACPI code into the kernel via the world-writable 'customdebug' file, allowing local privilege escalation. CVE-2010-4258: A local attack...

openSUSE Security Update : kernel (openSUSE-SU-2010:0655-1)

This update of the openSUSE 11.3 kernel fixes two local root exploits, various other security issues and some bugs. Following security issues are fixed by this update: CVE-2010-3301: Mismatch between 32bit and 64bit register usage in the system call entry path could be used by local attackers to...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 3068 / 3069 / 3070)

This SUSE Linux Enterprise 11 Service Pack 1 kernel contains various security fixes and lots of other bugfixes. Notable larger bugfixes and changes : - 603464: Fix system freezewhen doing a network crashdump with a netxennic driver - 610828: Avoid kernel failure on connects/disconnects to a novel...

CVE-2010-3861

The ethtoolgetrxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOLGRXCLSRLALL ethtool command with a large info.rulecnt value, a different...

CVE-2010-3084

CVE-2010-3084 refers to a buffer overflow in the Linux kernel 2.6 series (niu_get_ethtool_tcam_all in drivers/net/niu.c) exploitable via the ETHTOOL_GRXCLSRLALL ethtool command. Affected: Linux kernel older than 2.6.36-rc4. Impact described as local denial of service and potential other effects (...