CVE-2026-97435 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users of Linux-based systems should assess exposure and apply patches or workarounds to prevent potential exploitation. This involves verifying port indices and configurations, assessing and applying patches or updates provided by Linux kernel maintainers, and monitoring system logs for potential exploitation attempts or anomalies.

Why it matters

CVE-2026-97435 is a Linux kernel vulnerability that can cause cross-chip redirect issues, potentially leading to wrong port redirection or out-of-bounds access. Linux kernel maintainers, administrators, and users of Linux-based systems should assess exposure and apply patches or workarounds.

• Verify port indices and configurations to prevent cross-chip redirect issues
• Assess and apply patches or updates provided by Linux kernel maintainers
• Monitor system logs for potential exploitation attempts or anomalies

Technical summary

The Linux kernel's net: dsa: sja1105: flower component has a vulnerability that can cause cross-chip redirect issues. The dsa_port_from_netdev() function may return a valid port from a different switch chip, leading to wrong port redirection or out-of-bounds access if the index exceeds the local chip's port count. A minimal fix has been applied to catch this case and adjust the extack message. The fix ensures that the local hardware is not programmed with a port index from another switch chip, preventing redirection to the wrong port or out-of-bounds access.

Defensive priority

Assess and apply patches for Linux kernel vulnerabilities

Recommended defensive actions

• Assess exposure to CVE-2026-97435 in Linux kernel deployments
• Apply patches or updates provided by Linux kernel maintainers
• Verify system configurations and port indices for potential workarounds
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, which has been resolved in the Linux kernel. The dsa_port_from_netdev() function may return a valid port from a different switch chip, leading to wrong port redirection or out-of-bounds access if the index exceeds the local chip's port count. A minimal fix has been applied to catch this case and adjust the extack message. When cls-common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.