CVE-2026-98272

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: prevent buffer overflow in page_pool allocation

The per‑processor buffering scheme is supported only if the

number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).

This is already checked in mvpp2_probe() during the initial

activation of percpu_pools.

However, mvpp2_change_mtu() may later call

mvpp2_bm_switch_buffers(priv, true) without this check, which can

lead to an out-of-bounds access in the priv->page_pool array in

mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ

entries, and mvpp2_get_nrxqs() may return exactly that value. The

per-CPU scheme then doubles it to nrxqs * 2, exceeding the array

bounds.

Check that the hardware version is MVPP22 or newer and that the

number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS

before switching to per-CPU mode.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References