CVE-2026-98028

The Linux kernel’s nfp net filter driver replaces existing network filter rules. When the hardware programming of a new rule fails, the driver removes the rule from the hardware but fails to delete the corresponding entry from its software list, causing the in‑kernel counter of rules to report one rule fewer than the list actually contains. ETHTOOL queries this counter and allocates a buffer that is one rule short, so a subsequent walk of the list writes past the buffer’s boundary and returns a permanent EMSGSIZE error. This flaw does not provide code execution or data disclosure; it simply causes ETHTOOL operations to fail, interrupting normal network rule management.

The defect exists in any Linux kernel that incorporates the nfp net filter driver. Most mainstream distributions ship this driver, and custom kernel builds that enable it are also affected. No specific kernel version range is listed, so all kernels containing the unpatched nfp code are potentially impacted until the fix is applied.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. The flaw is local; an attacker must have privileged access to run ETHTOOL commands that modify filter rules. An attacker can repeatedly trigger the bug to cause a denial of service that interrupts rule configuration and potentially other network functions, but the impact is confined to the affected host.