CVE-2026-98272: Linux kernel · net: mvpp2: prevent buffer overflow in page_pool allocation
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 01:27 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). This is already checked in mvpp2_probe() during the initial activation of percpu_pools. However, mvpp2_change_mtu() may later call mvpp2_bm_switch_buffers(priv, true) without this check, which can lead to an out-of-bounds access in the priv->page_pool array in mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ entries, and mvpp2_get_nrxqs() may return exactly that value. The per-CPU scheme then doubles it to nrxqs * 2, exceeding the array bounds. Check that the hardware version is MVPP22 or newer and that the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS before switching to per-CPU mode. Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
- ubuntu.com/security/CVE-2026-98272 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98272 (opens in a new tab)
- git.kernel.org/linus/14cb1e7702e5cb3c58888f6aed498381a73927d2 (opens in a new tab)
- git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2 (opens in a new tab)
- git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a (opens in a new tab)
- git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545 (opens in a new tab)
- git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c (opens in a new tab)
- git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0 (opens in a new tab)
- git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c (opens in a new tab)
- git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384 (opens in a new tab)
- git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8 (opens in a new tab)