CVE-2026-98272 (GCVE-0-2026-98272)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:45 – Updated: 2026-10-06 08:45
VLAI
Title
net: mvpp2: prevent buffer overflow in page_pool allocation
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < 5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < 4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545 (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < dfd46b5584a5881b131008767950e1ab82713c8c (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < 6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0 (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < e7f30dcfa6c64033bf9137362517bd248e5be384 (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < f0e7d62c1eb984dd204095118973c59604144cd8 (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < 1734c3fc0066e228ce1c11e434b7c2527f0a949a (git)
Affected: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f , < 14cb1e7702e5cb3c58888f6aed498381a73927d2 (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "dfd46b5584a5881b131008767950e1ab82713c8c",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "e7f30dcfa6c64033bf9137362517bd248e5be384",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "f0e7d62c1eb984dd204095118973c59604144cd8",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "1734c3fc0066e228ce1c11e434b7c2527f0a949a",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            },
            {
              "lessThan": "14cb1e7702e5cb3c58888f6aed498381a73927d2",
              "status": "affected",
              "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv-\u003epage_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:45:33.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a"
        },
        {
          "url": "https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2"
        }
      ],
      "title": "net: mvpp2: prevent buffer overflow in page_pool allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98272",
    "datePublished": "2026-10-06T08:45:33.974Z",
    "dateReserved": "2026-09-25T10:25:14.333Z",
    "dateUpdated": "2026-10-06T08:45:33.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98272",
      "date": "2026-10-08",
      "epss": "0.00203",
      "percentile": "0.09454"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dfd46b5584a5881b131008767950e1ab82713c8c",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e7f30dcfa6c64033bf9137362517bd248e5be384",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0e7d62c1eb984dd204095118973c59604144cd8",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1734c3fc0066e228ce1c11e434b7c2527f0a949a",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14cb1e7702e5cb3c58888f6aed498381a73927d2",
                    "status": "affected",
                    "version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.4"
                  },
                  {
                    "lessThan": "5.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv-\u003epage_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
          }
        ],
        "id": "CVE-2026-98272",
        "lastModified": "2026-10-06T09:18:16.780",
        "metrics": {},
        "published": "2026-10-06T09:18:16.780",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-09T08:17:49+00:00",
      "cve": "CVE-2026-98272",
      "id": "CVE-2026-98272",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mvpp2: prevent buffer overflow in page_pool allocation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98272.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-08T16:48:52Z",
      "cve": "CVE-2026-98272",
      "id": "CVE-2026-98272",
      "initial_release_date": "2026-10-08T16:48:52Z",
      "product_status:known_affected": "158",
      "product_status:known_not_affected": "189",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98272",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98272.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.