by Kastro
Paper/Archive/CVE-2026-80617

CVE-2026-80617

Linux Linux — net: airoha: fix foe_check_time allocation size

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.3.533 × 2010.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.

Affected

ProductAffectedFixed inSource
Linux56b99327a451917f1c17f85fc33ea8293c08a9ee – < 112b5eff24e044561ee9599a0d34e0fcea1df4e0112b5eff24e044561ee9599a0d34e0fcea1df4e0CNA
Linux6d5b601d52a27aafff555b480e538507901c672c – < 9f7cd1e26d2f1766438edc9b9254f2c618f9ae989f7cd1e26d2f1766438edc9b9254f2c618f9ae98CNA
Linux6d5b601d52a27aafff555b480e538507901c672c – < 5c121ee635680c93d7074becf14cfbaac140f80d5c121ee635680c93d7074becf14cfbaac140f80dCNA
Linux6.18.33 – < 6.18.406.18.40CNA
Linux6.196.18.40CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/112b5eff24e044561ee9599a0d34e0fcea1df4e0refgit.kernel.org/stable/c/9f7cd1e26d2f1766438edc9b9254f2c618f9ae98refgit.kernel.org/stable/c/5c121ee635680c93d7074becf14cfbaac140f80d