CVE-2026-98028
kernel: eth: nfp: drop the replaced rule from the list when reprogramming fails
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 25, 2026
Updated · September 29, 2026
Description
A flaw was found in the Linux kernel's Netronome Flow Processor (NFP) network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local user with network administration privileges could trigger this condition, causing subsequent flow rule queries to fail permanently or potentially resulting in memory corruption. This issue primarily leads to a Denial of Service (DoS) for network management operations.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-459 · Incomplete Cleanup