CVE-2026-98808

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

When running on SYSTEMPORT Lite, certain statistics are unsupported and

skipped during bcm_sysport_get_stats(). The variable 'j' tracks the

compacted index into the destination data buffer, whereas 'i' iterates

over all elements in bcm_sysport_gstrings_stats.

Because the buffer allocated by ethtool is sized only according to

bcm_sysport_get_sset_count(), storing values at data[i] instead of

data[j] writes past the allocated array bounds, leading to memory

corruption.

Fix this by writing to data[j] instead of data[i].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References