CVE-2026-98302: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-h2fv-mm82-hjqj
Share
Published
Advisory Summary

CVE-2026-98302 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98302 at a Glance

CVE Identifier CVE-2026-98302
GHSA Identifier GHSA-h2fv-mm82-hjqj
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98302

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98302, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without checking netif_running(). ResetAdapter() first calls card_stop(), which sets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(), which walks the two transmit queues: for (i = QUEUE_S; i <= QUEUE_A0; i++) { queue = smc->hw.fp.tx[i] ; ... t = queue->tx_curr_get ; smc->hw.fp.tx[] is only populated by init_tx(), which is reached from skfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() -> init_mac() -> init_tx(). The private area is allocated and zeroed by alloc_fddidev(), so on an interface that has never been brought up both queue pointers are still NULL. The hw_state test at the top of mac_drv_clear_tx_queue() does not catch this, because card_stop() has just set STOPPED; the function proceeds into the loop and dereferences NULL. ResetAdapter() does call init_smt() itself, but only after the queues have been cleared. Setting the MAC address on a down interface therefore oopses: ip link set dev fddi0 address 02:00:00:00:00:01 BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp] Read of size 8 at addr 0000000000000010 by task ip/302 Call Trace: <TASK> mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b] ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b] skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b] netif_set_mac_address+0x1e4/0x2c0 do_setlink+0x684/0x2680 </TASK> Address 0x10 is the offset of tx_curr_get, the third pointer in struct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which ResetAdapter() calls immediately afterwards, dereferences smc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective hw_state test; the transmit queue merely crashes first. Both are covered by the guard below. Skip the adapter reset when the interface is down. dev_addr_set() is left unconditional, so the new address is still recorded in dev->dev_addr. Nothing is lost by not resetting the adapter here: skfp_open() deliberately re-reads the factory address on every open, read_address(smc, NULL); eth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a); and the comment above it states this is done to discard exactly such an address override across a close/open cycle. An address set while the interface is down could not have survived the following open even before this change, so the guard removes no working behaviour. Guarding the hardware side of ndo_set_mac_address() with netif_running() is established practice; skge_set_mac_address() has done so since commit 2eb3e621c4e0 ("skge: set mac address bonding fix"). Guarding the reset as a whole, rather than NULL-checking the queues, is also what the rest of the driver expects. After a previous open/close the queue pointers are stale but non-NULL, so there is no crash, yet ResetAdapter() goes on to call smt_online() and STI_FBI() ("Enable Board Interrupts") while skfp_close() has already called free_irq() - the adapter would be brought back online with no handler installed. The only other ResetAdapter() caller is skfp_interrupt(), which by construction runs only while the device is open. Found by automated driver testing against an emulated SysKonnect FDDI adapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires CAP_NET_ADMIN.

References

NVD — CVE-2026-98302 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98302
git.kernel.org/stable/c/438131e7ae... WEB
https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c
git.kernel.org/stable/c/5fd0f401b3... WEB
https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0
git.kernel.org/stable/c/616ba18b2c... WEB
https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc
git.kernel.org/stable/c/731db6110b... WEB
https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9
git.kernel.org/stable/c/7c8810c2e6... WEB
https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1
git.kernel.org/stable/c/822903ed99... WEB
https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30
git.kernel.org/stable/c/835903bea7... WEB
https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3
git.kernel.org/stable/c/d6f63fdb29... WEB
https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04

Frequently Asked Questions

What is CVE-2026-98302?
CVE-2026-98302 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98302?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98302?
CVE-2026-98302 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98302?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h2fv-mm82-hjqj",
  "modified" : "2026-10-06T09:31:34Z",
  "published" : "2026-10-06T09:31:34Z",
  "aliases" : [ "CVE-2026-98302" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i <= QUEUE_A0; i++) {\n\t\tqueue = smc->hw.fp.tx[i] ;\n\t\t...\n\t\tt = queue->tx_curr_get ;\n\nsmc->hw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->\ninit_mac() -> init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n  ip link set dev fddi0 address 02:00:00:00:00:01\n\n  BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n  Read of size 8 at addr 0000000000000010 by task ip/302\n  Call Trace:\n   <TASK>\n   mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n   netif_set_mac_address+0x1e4/0x2c0\n   do_setlink+0x684/0x2680\n   </TASK>\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev->dev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98302"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-06T09:18:21Z"
  }
}