CVE-2026-98028 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, system administrators responsible for kernel updates, and userspace application developers relying on ETHTOOL_GRXCLSRLCNT and GRXCLSRLALL operations

Why it matters

A vulnerability in the Linux kernel could lead to incorrect buffer sizing in userspace applications, potentially causing -EMSGSIZE errors. Verification and patch deployment are necessary to prevent potential issues.

• Verification of kernel version and patch deployment is necessary to prevent potential issues
• Userspace applications may need to be updated to handle the -EMSGSIZE error correctly
• System administrators should monitor for potential errors in userspace applications

Technical summary

The nfp_net_fs_add() function in the Linux kernel does not properly handle rule replacement when reprogramming fails. This can lead to a mismatch between the expected and actual list lengths, causing userspace applications to size their buffers incorrectly. The function replaces an existing rule by deleting it from the hardware, decrementing nn->fs.count, and programming the new one. If nfp_net_fs_add_hw() fails, the old entry stays on nn->fs.list, only the success path reaches list_replace(), so the list is one longer than nn->fs.count. This discrepancy can cause -EMSGSIZE errors when userspace applications attempt to walk the list.

Defensive priority

Verify and apply kernel updates to ensure the fix is deployed.

Recommended defensive actions

• Verify kernel version and apply updates if necessary
• Review system configurations for potential exposure
• Monitor for potential -EMSGSIZE errors in userspace applications
• Perform a thorough review of the affected system's configurations and apply compensating controls if necessary
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue arises from the nfp_net_fs_add() function not properly updating the list when reprogramming fails. The old entry remains on nn->fs.list, causing a mismatch between nn->fs.count and the actual list length.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.