Linux Kernel idpf Driver OOB Write via VIRTCHNL2 Alloc Vectors Reply
CVE-2026-80693 Published on August 28, 2026
idpf: bound interrupt-vector register fill to the allocated array
In the Linux kernel, the following vulnerability has been resolved:
idpf: bound interrupt-vector register fill to the allocated array
idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding
its inner loop only by the per-chunk num_vectors. The array is sized
separately: idpf_intr_reg_init() allocates
kzalloc_objs(struct idpf_vec_regs, total_vecs) from
caps.num_allocated_vectors and only checks the returned count after the
fill. The sum of per-chunk num_vectors is never reconciled against
total_vecs, so a reply with a small num_allocated_vectors but chunks
summing higher writes past the end of reg_vals[].
Impact: a control plane (a PF or hypervisor device model) that returns a
VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds
num_allocated_vectors writes struct idpf_vec_regs entries past the end of
the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).
Bound the fill loop to the array capacity passed in by the callers,
mirroring the sibling idpf_vport_get_q_reg(). The existing
num_regs < num_vecs check then rejects an undersized reply without the
out-of-bounds write happening first.
Products Associated with CVE-2026-80693
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d4d5587182664b0c4ab6d3556ce881cb975507c2 and below 41bb8748124d0d8ee5d8e1eace9dfbc874bc9564 is affected.
- Version d4d5587182664b0c4ab6d3556ce881cb975507c2 and below 9f7007ee9858c99aa43101bc8352c672fee85644 is affected.
- Version 6.7 is affected.
- Before 6.7 is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.