CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
A buffer overflow in the Linux kernel's SYSTEMPORT Lite driver allows attackers to cause memory corruption, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98808?
CVE-2026-98808 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats.
Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption.
Fix this by writing to data[j] instead of data[i].
Which versions are affected by CVE-2026-98808?
How do I fix CVE-2026-98808?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98808 being exploited?
There is no known exploitation of CVE-2026-98808 in the wild and no public exploit code.
Sources
Also known as AZL-109074, BELL-CVE-2026-98808, DEBIAN-CVE-2026-98808, GHSA-887q-3qpv-x22r, UBUNTU-CVE-2026-98808.