CVE-2026-98272
net: mvpp2: prevent buffer overflow in page_pool allocation
No known exploitation. EPSS puts it in the 10th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f, < 5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3cUpgrade to: 5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3cAffected: ≥ 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f, < 4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545Upgrade to: 4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545Affected: ≥ 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f, < dfd46b5584a5881b131008767950e1ab82713c8cUpgrade to: dfd46b5584a5881b131008767950e1ab82713c8cAffected: ≥ 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f, < 6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0Upgrade to: 6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0 + 4 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 10th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2
- git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a
- git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545
And 5 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI