{"id":"CVE-2026-80693","revision":"c404b7dd65d947919affc2d7763030f1","records":[{"revision":"c404b7dd65d947919affc2d7763030f1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80693","aliases":[],"title":"idpf: bound interrupt-vector register fill to the allocated array","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: bound interrupt-vector register fill to the allocated array\n\nidpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from\nthe VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding\nits inner loop only by the per-chunk num_vectors. The array is sized\nseparately: idpf_intr_reg_init() allocates\nkzalloc_objs(struct idpf_vec_regs, total_vecs) from\ncaps.num_allocated_vectors and only checks the returned count after the\nfill. The sum of per-chunk num_vectors is never reconciled against\ntotal_vecs, so a reply with a small num_allocated_vectors but chunks\nsumming higher writes past the end of reg_vals[].\n\nImpact: a control plane (a PF or hypervisor device model) that returns a\nVIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds\nnum_allocated_vectors writes struct idpf_vec_regs entries past the end of\nthe reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).\n\nBound the fill loop to the array capacity passed in by the callers,\nmirroring the sibling idpf_vport_get_q_reg(). The existing\nnum_regs < num_vecs check then rejects an undersized reply without the\nout-of-bounds write happening first.","state":0,"publishedAt":"2026-08-28T06:52:56.131+00:00","modifiedAt":"2026-10-21T12:46:53.892+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/idpf/idpf_dev.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_vf_dev.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d4d5587182664b0c4ab6d3556ce881cb975507c2\",\n                            \"lessThan\": \"a6447b6a9678e701ca4d32789f311067cf528c2d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d4d5587182664b0c4ab6d3556ce881cb975507c2\",\n                            \"lessThan\": \"e299b7d1334ebec4d43a7bb697d10c12df1aaed3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d4d5587182664b0c4ab6d3556ce881cb975507c2\",\n                            \"lessThan\": \"41bb8748124d0d8ee5d8e1eace9dfbc874bc9564\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d4d5587182664b0c4ab6d3556ce881cb975507c2\",\n                            \"lessThan\": \"9f7007ee9858c99aa43101bc8352c672fee85644\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/idpf/idpf_dev.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_vf_dev.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c\",\n                        \"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.3,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/a6447b6a9678e701ca4d32789f311067cf528c2d","https://git.kernel.org/stable/c/e299b7d1334ebec4d43a7bb697d10c12df1aaed3","https://git.kernel.org/stable/c/41bb8748124d0d8ee5d8e1eace9dfbc874bc9564","https://git.kernel.org/stable/c/9f7007ee9858c99aa43101bc8352c672fee85644"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80693","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80693","identifiers":["CVE-2026-80693"]},"retained":false,"historicalAffected":[]}],"coverage":[]}