CVE intelligence

CVE-2026-97435

Vulnerability intelligence

Published Sep 24, 2026Sources checked Nov 12, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-97435. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 22, 2026

Release Notes

Vendor-listed releases

6.6.158.1-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-97435?

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: sja1105: flower: reject cross-chip redirect

dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count.

Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not addressed here.

Source: NVD