---
id: "CVE-2026-98808"
kind: "vulnerability"
aliases: ["CVE-2026-98808"]
title: "Linux kernel: SYSTEMPORT ethtool stats write past buffer, corrupting memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["broadcom-soc", "embedded", "infrastructure", "linux-kernel"]
not_affected_if: ["no-systemport-hardware"]
published_at: "2026-10-18T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:14:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98808", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: SYSTEMPORT ethtool stats write past buffer, corrupting memory

On Broadcom SYSTEMPORT Lite network adapters, the driver writes statistics to the wrong index when some counters are skipped, overrunning the buffer ethtool allocated. The memory corruption could crash the kernel or be leveraged further, though the sources do not say.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the commit fixing bcm_sysport_get_stats() to write to data[j] (versions unknown from sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98808

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

When running on SYSTEMPORT Lite, certain statistics are unsupported and
skipped during bcm_sysport_get_stats(). The variable 'j' tracks the
compacted index into the destination data buffer, whereas 'i' iterates
over all elements in bcm_sysport_gstrings_stats.

Because the buffer allocated by ethtool is sized only according to
bcm_sysport_get_sset_count(), storing values at data[i] instead of
data[j] writes past the allocated array bounds, leading to memory
corruption.

Fix this by writing to data[j] instead of data[i].

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_