Linux Kernel EUVD-2026-86683

Requires local access to a system running the Linux net/dsa bcm_sf2 driver, i.e. hardware with a Broadcom Starfighter2 integrated Ethernet switch (embedded/networking devices). Exploitation is only possible AFTER a privileged administrator (CAP_NET_ADMIN) has installed one or more CFP classification rules - the low-privileged attacker cannot create this precondition themselves. Given that state, any user can trigger it via the ETHTOOL_GRXCLSRLALL ethtool ioctl (which itself needs no CAP_NET_ADMIN) by passing a rule_cnt smaller than the number of installed rules (or 0 to force the NULL-pointer path). Limiting factors: local-only vector, requirement of pre-installed CFP rules, and Broadcom-SF2-specific hardware/driver - this does not affect generic or default Linux deployments.

This is a high-CVSS-but-modest-real-risk issue when the full signal set is weighed. The NVD CVSS 3.1 vector (7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) already constrains it to a LOCAL attacker with LOW privileges and HIGH attack complexity - not a remotely exploitable flaw. No EPSS score, no CISA KEV listing, and no public POC accompany this CVE, so there is no evidence of exploitation interest; SSVC would read as Exploitation:none, Automatable:no (a local ioctl race/precondition, not internet-scannable). The C:H/I:H claim in the NVD vector is questionable: the description characterizes this as an out-of-bounds WRITE off the end of a kernel allocation (and a NULL-pointer dereference when rule_cnt=0), which is a memory-corruption/DoS primitive, not a confidentiality leak - the 'Information Disclosure' tag is inconsistent with the actual bug class. The AC:H rating is well-justified because the vulnerable dump path only produces out-of-bounds behavior AFTER a privileged admin (CAP_NET_ADMIN) has already installed CFP rules on the Broadcom SF2 switch, a precondition the low-privileged attacker does not control. Net assessment: real but low priority - a locally-triggerable kernel crash/corruption on embedded Broadcom-switch hardware, not a widespread or urgently-exploited threat. Independent estimate is closer to ~5.0 (A:H dominant, C:N/I:L).

On a device using the Broadcom Starfighter2 (bcm_sf2) DSA switch where an administrator has already installed CFP classification rules, a local low-privileged user issues an ETHTOOL_GRXCLSRLALL ioctl (which requires no CAP_NET_ADMIN) while deliberately passing a rule_cnt smaller than the number of installed rules. The kernel's bcm_sf2_cfp_rule_get_all() ignores that count and walks the entire cfp.unique bitmap into the undersized rule_locs[] buffer, writing past the allocation; a rule_cnt of 0 leaves the buffer pointer NULL and the walk dereferences it, crashing the kernel. No public exploit code exists at time of analysis.