Answer in brief
CVE-2026-98808 records a Unknown severity vulnerability in net: systemport: Fix buffer overflow in bcm_sysport_get_stats(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=10377ba7673d19e28d92846955d51f49acd25c35 <29d1d35ad5ad379a904263ea1cd4ba1d71cd965f || >=10377ba7673d19e28d92846955d51f49acd25c35 <96d8b26be5bc451188acdcee055948da45adbde0 || >=10377ba7673d19e28d92846955d51f49acd25c35 <faba9fdde480356f4a1d3b1a5713b7b354858a1c || >=10377ba7673d19e28d92846955d51f49acd25c35 <eb7b84af0ec5c71b4920e999611b466b3784496c | 29d1d35ad5ad379a904263ea1cd4ba1d71cd965f, 96d8b26be5bc451188acdcee055948da45adbde0, faba9fdde480356f4a1d3b1a5713b7b354858a1c, eb7b84af0ec5c71b4920e999611b466b3784496c |
| Linux/Linuxgeneric | 4.14 | Not reported |
| Linux/Linuxgeneric | >=10377ba7673d19e28d92846955d51f49acd25c35 <96a2b042051553df0d9f03b518dd3b7105b36935 || >=10377ba7673d19e28d92846955d51f49acd25c35 <29d1d35ad5ad379a904263ea1cd4ba1d71cd965f || >=10377ba7673d19e28d92846955d51f49acd25c35 <96d8b26be5bc451188acdcee055948da45adbde0 || >=10377ba7673d19e28d92846955d51f49acd25c35 <faba9fdde480356f4a1d3b1a5713b7b354858a1c || >=10377ba7673d19e28d92846955d51f49acd25c35 <eb7b84af0ec5c71b4920e999611b466b3784496c | 96a2b042051553df0d9f03b518dd3b7105b36935, 29d1d35ad5ad379a904263ea1cd4ba1d71cd965f, 96d8b26be5bc451188acdcee055948da45adbde0, faba9fdde480356f4a1d3b1a5713b7b354858a1c, eb7b84af0ec5c71b4920e999611b466b3784496c |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm_sysport_get_stats(). The variable 'j' tracks the compacted index into the destination data buffer, whereas 'i' iterates over all elements in bcm_sysport_gstrings_stats. Because the buffer allocated by ethtool is sized only according to bcm_sysport_get_sset_count(), storing values at data[i] instead of data[j] writes past the allocated array bounds, leading to memory corruption. Fix this by writing to data[j] instead of data[i].
Quoted source text, attributed separately from HOL analysis.