CVE-2026-98272 net: mvpp2: prevent buffer overflow in page_pool allocation
A buffer overflow in the Marvell mvpp2 network driver allows attackers to cause denial of service or execute code via MTU changes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98272?
CVE-2026-98272 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: prevent buffer overflow in page_pool allocation
The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools.
However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds.
Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Which versions are affected by CVE-2026-98272?
How do I fix CVE-2026-98272?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98272 being exploited?
There is no known exploitation of CVE-2026-98272 in the wild and no public exploit code.
Sources
Also known as AZL-106479, BELL-CVE-2026-98272, DEBIAN-CVE-2026-98272, GHSA-986m-q5f3-3m78, UBUNTU-CVE-2026-98272.