The Linux kernel BCM‑SF2 device driver contains a flaw that fails to bound the number of Channel Flow Pattern (CFP) rules copied to a user buffer. When an ETHTOOL_GRXCLSRLALL ioctl is issued, the driver walks the entire CFP bitmap and writes each rule location to the caller’s array without respecting the rule count supplied by the user. A local user can therefore request fewer slots than actually exist, causing the driver to copy beyond the allocated buffer or dereference a NULL pointer when zero slots are requested. This memory corruption can trigger a kernel panic, resulting in a denial of service.

Systems running Linux kernels that include the bcm_sf2 network driver and have CFP rule configuration enabled are impacted. Users can trigger the vulnerability via the ETHTOOL_GRXCLSRLALL ioctl, which does not require CAP_NET_ADMIN. Any distribution that has not applied the committed patch to the bcm_sf2 driver is vulnerable. Kernel configurations that never load the bcm_sf2 module or do not support CFP rule configuration are not affected.

The flaw is triggered by a local ioctl that does not require privileged capabilities; thus any authenticated local user can invoke it after CFP rules have been installed. The EPSS score indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7 signals high severity. The combination of a local trigger, lack of privilege checks, and the potential for kernel memory corruption makes this a high‑risk vector for denial of service.