CVE-2026-80693

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

idpf: bound interrupt-vector register fill to the allocated array

idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from

the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding

its inner loop only by the per-chunk num_vectors. The array is sized

separately: idpf_intr_reg_init() allocates

kzalloc_objs(struct idpf_vec_regs, total_vecs) from

caps.num_allocated_vectors and only checks the returned count after the

fill. The sum of per-chunk num_vectors is never reconciled against

total_vecs, so a reply with a small num_allocated_vectors but chunks

summing higher writes past the end of reg_vals[].

Impact: a control plane (a PF or hypervisor device model) that returns a

VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds

num_allocated_vectors writes struct idpf_vec_regs entries past the end of

the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).

Bound

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References