What is the CVSS score of CVE-2026-98027?

CVE-2026-98027 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-98027?

Within 24 hours, inventory Linux hosts that use the mv88e6xxx DSA switch driver with Marvell switch hardware and have at least one RX-flow classification rule installed, and restrict local account access on those hosts until patched. Within 7 days, apply vendor-released patches by upgrading to Linux stable versions 6.12.111, 6.18.53, 7.2.7, or 7.3-rc3, or the corresponding vendor backport, then test and reboot affected systems. Within 30 days, verify patch compliance across all inventoried hosts, remove unnecessary RX-flow classification rules where operationally feasible, and monitor for kernel crashes or unusual local privilege activity; vendor patch is available so prioritize remediation over long-term compensating controls.

Linux Kernel CVE-2026-98027

EUVD-2026-86680 HIGH

2026-09-25 Linux

GHSA-rmvm-8mw4-j874

Linux Red Hat Suse

7.0

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local unprivileged shell on host
Delivery

Admin has pre-installed mv88e6xxx policy rules
Exploit

Call ETHTOOL_GRXCLSRLALL with undersized rule_cnt
Execution

Walk uses rule_cnt as write index past buffer
Persist

OOB write / NULL deref in kernel
Impact

Kernel panic (denial of service)

Vulnerability Assessment

Exploitation Conditions	Requires (1) hardware/config using the mv88e6xxx DSA Ethernet switch driver, (2) a privileged administrator (CAP_NET_ADMIN) to have previously installed at least one RX-flow policy rule, and (3) a local user account to issue the ETHTOOL_GRXCLSRLALL ioctl, which itself needs no CAP_NET_ADMIN. Exploitation is limited by the need for that non-default prior admin action (policy rules installed) and by requiring specific Marvell switch hardware; it is local-only (no network vector) and yields a kernel crash rather than code execution or data theft.
Impact	This is a high-CVSS-but-modest-real-risk kernel bug. NVD scores it 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but the C:H/I:H impact rating is overstated: the description characterizes the flaw as running 'off the end of the allocation' (an OOB write of policy-rule IDs) plus a NULL-pointer dereference when rule_cnt=0 - both crash/DoS primitives, not a confidmed confidentiality or integrity breach against userspace. There is no evidence of data exfiltration to the caller. The AC:H is well-justified: exploitation is only possible AFTER a privileged admin (CAP_NET_ADMIN) has installed at least one mv88e6xxx policy rule, a precondition the attacker does not control. There is no EPSS score, no CISA KEV listing, and no public POC. My independent read is ~5.0. Note the signal conflict: the CVSS vector correctly says AV:L (local ioctl), but the 'Information Disclosure' tag mislabels what is fundamentally an out-of-bounds write / NULL-deref denial-of-service - verify against the patch commits which add an -EMSGSIZE bound.
Exploit ScenarioDerived	On a system using a Marvell 88E6xxx DSA-managed switch where an administrator has already installed one or more RX-flow policy rules, a local unprivileged user issues an ETHTOOL_GRXCLSRLALL ioctl (which requires no CAP_NET_ADMIN) requesting fewer buffer slots than there are installed rules, or a rule_cnt of 0. The kernel walk uses the caller-supplied rule_cnt as a write index and runs past the allocation (or dereferences a NULL buffer), corrupting kernel memory and crashing the host. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

The mv88e6xxx DSA switch driver in the Linux kernel can be driven into an out-of-bounds kernel memory write - or a NULL-pointer dereference - by a local user issuing the ETHTOOL_GRXCLSRLALL ioctl on a host where an administrator has previously installed at least one RX-flow classification rule; the ioctl requires no CAP_NET_ADMIN, so any local account can reach the buggy path, although the most likely outcome is a kernel crash with limited integrity impact rather than code execution or data theft. The defect is a missing bound on the policy-rule dump: the caller's rule_cnt buffer limit is clobbered by the driver before it is ever read, and a value of 0 leaves the destination pointer NULL. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor fixes are available in the stable trees (6.12.111, 6.18.53, 7.2.7 and 7.3-rc3), and per the independent assessment exploitation is gated on non-default prerequisites - Marvell switch hardware using this driver plus pre-existing policy rules installed by a privileged administrator.

RemediationAI

Update to a kernel release that contains the fix: vendor patches are available in Linux 6.12.111, 6.18.53 and 7.2.7, with the fix also present in 7.3-rc3, corresponding to the stable commits 44cd4674d9aa5bdf793b8a8b481c9e8536ed6070, 7a683c2b062810bca203e41866389daf387c235b, cda5ac8fe8ac8e80b1703ebb8c4250726fc19739 and b1fffc273112e7284c5b705e186b43b5770cd3d5; consult your distribution's kernel advisory and rebuild/reboot into the patched image, since a kernel fix requires a restart to take effect. Because exploitation requires that at least one RX-flow policy rule already be installed on the switch port, the most direct compensating control is to keep the policy IDR empty - list and delete rules with ethtool -N <iface> (RX flow classification) and avoid installing new ones until the kernel is patched; the trade-off is loss of hardware flow steering/classification for any workload relying on it, and the state must be re-audited after every configuration change or reboot-driven restore. A rule_cnt of zero is the most reliable trigger, so if you cannot immediately remove rules, consider confining untrusted local users so they cannot issue arbitrary SIOCETHTOOL ioctls (for example via a seccomp filter or container runtime policy that blocks the ioctl) - this reduces the attack surface but breaks legitimate ethtool usage such as ethtool -N/-n queries and statistics collection for those processes, and it is bypassable by any user with a shell outside the constrained profile. Kernel live-patching or reverting to a build without the mv88e6xxx module (blacklisting or not loading the driver) also removes the vulnerable code path on hosts that do not need the Marvell switch, at the cost of losing switch management and data-plane offload functionality; no vendor-released standalone workaround beyond upgrading is documented.

Affected VersionsENISA

Linux 5.4

Linux da7dc87553046a43be1620a783ce3d9f6583d322 <b1fffc273112e7284c5b705e186b43b5770cd3d5

Linux patch: 6.12.111

Linux patch: 6.18.53

Linux da7dc87553046a43be1620a783ce3d9f6583d322 <cda5ac8fe8ac8e80b1703ebb8c4250726fc19739

Linux da7dc87553046a43be1620a783ce3d9f6583d322 <44cd4674d9aa5bdf793b8a8b481c9e8536ed6070

Linux patch: 7.3-rc3

Linux patch: 0

Linux da7dc87553046a43be1620a783ce3d9f6583d322 <7a683c2b062810bca203e41866389daf387c235b

Linux patch: 7.2.7

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The mv88e6xxx driver is the DSA (Distributed Switch Architecture) driver for Marvell 88E6xxx family Ethernet switch chips, exposing switch policy/classification rules to user space through the legacy ethtool RX-flow-classification interface (ETHTOOL_GRXCLSRLALL, dispatched through SIOCETHTOOL). Internally the rules are stored in an IDR (a radix-tree-backed integer ID map), and mv88e6xxx_get_rxnfc() walks that IDR to copy rule identifiers back to the caller's buffer. Struct ethtool_rxnfc uses the field rule_cnt in two directions: on input it is the number of slots the caller allocated, on output the number of entries actually found. The driver reused that same field as its write index during the IDR walk, destroying the input capacity before it was consulted; as a result the walk is not bounded by the user-supplied allocation and can write past its end, while a caller-supplied rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it. The ioctl sizes the kernel-side buffer from the rule_cnt value passed by user space and, unlike rule installation which requires CAP_NET_ADMIN, ETHTOOL_GRXCLSRLALL is not privileged, so a local unprivileged user can supply a small (or zero) capacity while the admin-installed policy set is larger. No CWE identifier is supplied in the source data; the defect pattern corresponds to the out-of-bounds-write and NULL-pointer-dereference classes. The upstream fix counts into a local variable so the caller's limit survives the walk and terminates the loop with -EMSGSIZE once that limit is reached.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 5.3 MEDIUM

Local ioctl (AV:L) by an unprivileged user (PR:L); AC:H because an admin must first install policy rules; impact is OOB-write/NULL-deref crash (A:H, minor I, no confirmed disclosure C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE 6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 25, 2026 - 15:22 NVD

7.0 (HIGH)

Patch available

Sep 25, 2026 - 11:02 EUVD

CVE Published

Sep 25, 2026 - 10:23 cve.org

HIGH 7.0

CVE Published

Sep 25, 2026 - 10:23 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

mv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input is the number of entries the caller had room for. ETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the buffer from the rule_cnt userspace passes in, so once an admin has installed policy rules any user can ask for fewer slots than there are rules and run off the end of the allocation. A rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it.

Count into a local so the caller's limit survives the walk, and stop with -EMSGSIZE once it is reached.

Executive ViewAI

Why It Matters

Linux kernel hosts using the mv88e6xxx DSA switch driver for Marvell switch hardware face a high-severity local denial-of-service and limited integrity risk: a local user can trigger an out-of-bounds memory write or NULL-pointer dereference when RX-flow classification rules are present, most likely causing a kernel crash. The issue requires non-default prerequisites-Marvell switch hardware and at least one administrator-installed RX-flow classification rule-and no public exploit identified at time of analysis, with the issue not listed in CISA KEV. Leadership should care because affected network infrastructure hosts could suffer unplanned outages, and vendor patches are available.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 98% exploitable

Prevalence

Low

Marvell 88E6xxx DSA switch driver, niche embedded/networking hardware

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back