CVE-2026-98272
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected versions
Linux kernel versions
5.4
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98272?
CVE-2026-98272 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.4 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98272 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98272?
Yes. CVE-2026-98272 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 5.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98272 actively exploited?
No. CVE-2026-98272 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.