Cloudanix VulnDB

CVE-2026-98808

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A statistics-gathering function in certain Linux network drivers can write data outside its allowed memory space, which may cause crashes or instability on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Other
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow in bcm_sysport_get_stats() on SYSTEMPORT Lite hardware: the loop writes stats values using the full index 'i' into an ethtool buffer sized only for the compacted count returned by bcm_sysport_get_sset_count(), overwriting memory past the allocated array.

Why it matters to the business

Memory corruption in the network driver can cause kernel instability, crashes, or unpredictable behavior on affected Linux systems; low EPSS and no KEV listing indicate limited real-world urgency five days after publication.

How an attack unfolds

An attacker with local access or the ability to invoke ethtool statistics queries on a SYSTEMPORT Lite interface triggers the flawed loop, causing out-of-bounds writes during stats collection and potential memory corruption.

How to fix it

Apply the upstream fix that changes data[i] writes to data[j] in bcm_sysport_get_stats(); rebuild and deploy the corrected kernel; monitor for official stable releases that include the patch.

How to confirm the fix worked

Confirm the source change replaces data[i] with data[j] inside the stats loop; run ethtool statistics collection on SYSTEMPORT Lite hardware and verify no buffer overruns or kernel warnings occur.

Typical attack path

  1. Locate a Linux system using the bcm_sysport driver on SYSTEMPORT Lite hardware
  2. Invoke ethtool -S or equivalent stats query against the affected interface
  3. Trigger the loop that indexes with 'i' instead of the compacted 'j'
  4. Observe resulting memory corruption or system instability

How to detect it

Monitor kernel logs for buffer-overrun warnings or crashes during ethtool statistics collection on bcm_sysport interfaces; correlate with SYSTEMPORT Lite hardware presence.

What your security team should do

  • Prioritize patching kernel images that include bcm_sysport on SYSTEMPORT Lite devices
  • Review ethtool usage in monitoring scripts for exposure on affected hardware
  • Test the corrected driver in a lab environment before broad deployment
  • Track kernel changelog entries for the published fix over the next 30 days

The record

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].

Affected packages

Ecosystem Package Introduced Fixed