{"id":"CVE-2026-98808","kind":"vulnerability","aliases":["CVE-2026-98808"],"related":[],"title":"Linux kernel: SYSTEMPORT ethtool stats write past buffer, corrupting memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: Fix buffer overflow in bcm_sysport_get_stats()\n\nWhen running on SYSTEMPORT Lite, certain statistics are unsupported and\nskipped during bcm_sysport_get_stats(). The variable 'j' tracks the\ncompacted index into the destination data buffer, whereas 'i' iterates\nover all elements in bcm_sysport_gstrings_stats.\n\nBecause the buffer allocated by ethtool is sized only according to\nbcm_sysport_get_sset_count(), storing values at data[i] instead of\ndata[j] writes past the allocated array bounds, leading to memory\ncorruption.\n\nFix this by writing to data[j] instead of data[i].","summary":"On Broadcom SYSTEMPORT Lite network adapters, the driver writes statistics to the wrong index when some counters are skipped, overrunning the buffer ethtool allocated. The memory corruption could crash the kernel or be leveraged further, though the sources do not say.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["broadcom-soc","embedded","infrastructure","linux-kernel"],"not_affected_if":["no-systemport-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the commit fixing bcm_sysport_get_stats() to write to data[j] (versions unknown from sources)","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:14:57+00:00","updated_at":"2026-10-25T05:14:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:14:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the commit fixing bcm_sysport_get_stats() to write to data[j] (versions unknown from sources)","reach":"local","title":"Linux kernel: SYSTEMPORT ethtool stats write past buffer, corrupting memory","impact":"medium","summary":"On Broadcom SYSTEMPORT Lite network adapters, the driver writes statistics to the wrong index when some counters are skipped, overrunning the buffer ethtool allocated. The memory corruption could crash the kernel or be leveraged further, though the sources do not say.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","broadcom-soc","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"memory corruption in the kernel, possibly a crash","analyst_note":"Check the upstream kernel commit and NVD entry for affected versions, whether ethtool stats are reachable by unprivileged users, and any exploitability assessment.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-systemport-hardware"],"who_is_affected":"Systems running the Linux kernel with the Broadcom SYSTEMPORT or SYSTEMPORT Lite network driver, typically certain Broadcom set-top box and SoC platforms. Systems without this hardware driver can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3463,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98808':13A,16A 'accord':134C 'adapt':30B 'alloc':48B,128C,153C 'array':154C 'bcm':82C,98C,121C,136C 'bound':155C 'broadcom':18B,26B 'broadcom-soc':17B 'buffer':8A,46B,79C,113C,127C 'certain':91C 'compact':107C 'corrupt':9A,51B,159C 'could':52B 'count':140C 'counter':41B 'crash':53B 'cve':11A,14A 'data':112C,144C,148C,165C,169C 'destin':111C 'driver':32B 'element':119C 'embed':20B 'ethtool':4A,47B,130C 'fix':78C,160C 'follow':71C 'get':84C,100C,138C 'gstring':123C 'index':38B,108C 'infrastructur':21B 'instead':146C,167C 'iter':116C 'j':104C,149C,166C 'kernel':2A,24B,55B,69C 'lead':156C 'leverag':58B 'linux':1A,23B,68C 'linux-kernel':22B 'lite':28B,90C 'memori':10A,50B,158C 'net':76C 'network':29B 'overflow':80C 'overrun':44B 'past':7A,151C 'resolv':75C 'run':87C 'say':65B 'size':132C 'skip':43B,96C 'soc':19B 'sourc':62B 'sset':139C 'stat':5A,85C,101C,124C 'statist':34B,92C 'store':141C 'sysport':83C,99C,122C,137C 'systemport':3A,27B,77C,89C 'though':60B 'track':105C 'unsupport':94C 'valu':142C 'variabl':103C 'vulner':72C 'wherea':114C 'write':6A,33B,150C,163C 'wrong':37B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the Broadcom SYSTEMPORT or SYSTEMPORT Lite network driver, typically certain Broadcom set-top box and SoC platforms. Systems without this hardware driver can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98808","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-21T13:21:47+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}