CVE-2026-98029

The vulnerability resides in the nfp network driver of the Linux kernel. It allows an attacker to invoke the ETHTOOL_GRXCLSRLALL ioctl to dump all flow steering ntuple rules into a caller-provided buffer, but the driver ignores the rule_cnt supplied by the caller and writes past the end of that buffer. The ioctl does not require CAP_NET_ADMIN, meaning any local user can trigger the overrun. Writing past the buffer boundary corrupts kernel memory, which can lead to a kernel panic, data corruption, or a local privilege escalation if the overwritten data influences kernel behavior.

All Linux kernel releases that include the nfp driver and have not yet applied the bounds‑check patch are potentially affected. This includes every kernel version where the nfp driver is present and the official patch has not been applied. Specific vendor or distribution version details are not provided in the CNA data, so any kernel build that contains the vulnerable nfp implementation must be evaluated for patch status.

The CVSS score of 7 denotes moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. The attack can be performed by any local user through a standard ioctl call, with no elevated privileges required. An out‑of‑bounds write that corrupts kernel memory could result in a denial of service or facilitate privilege escalation if the attacker can manipulate the overwritten data.