{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80617","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.774Z","datePublished":"2026-08-28T06:48:37.508Z","dateUpdated":"2026-08-29T06:21:25.270Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:21:25.270Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: fix foe_check_time allocation size\n\nfoe_check_time is declared as u16 pointer but was allocated with\nonly ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).\n\nWhen airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2,\nit writes beyond the allocated buffer, causing heap buffer overflow and\npotential kernel crash."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The overflow is reached from netdev RX when hardware PPE reports HIT_UNBIND_RATE_REACHED; on Airoha EN7581/AN7583 CPE/router SoCs this path is driven by remotely sourced Ethernet WAN/LAN or WiFi traffic without local syscall access.\nAC:L - An attacker controls packet 5-tuples and send rate to populate FOE entries and force CPU-reason 0x0f; roughly half of valid hash indices (hash >= ppe_num_entries/2) deterministically hit the undersized buffer, with only a 100ms per-hash software throttle.\nPR:N - Exploitation requires only the ability to send network packets to or through the device's registered interfaces; no local account, capability, namespace admin rights, or authentication on the RX/offload path.\nUI:N - No cooperative victim action is needed beyond normal always-on routing/bridging of attacker-supplied packets through the Airoha Ethernet or mt76 WiFi RX handlers.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the host running the Airoha driver; it does not cross a VM, hypervisor, or IOMMU security boundary.\nC:H - airoha_ppe_check_skb() performs an out-of-bounds read of ppe->foe_check_time[hash] before writing a u16 timestamp, and the adjacent heap overflow can expose or corrupt neighboring kernel objects.\nI:H - The same path writes a u16 beyond the allocated foe_check_time buffer, giving a kernel heap out-of-bounds write that can be leveraged for further memory corruption or control-flow manipulation.\nA:H - The fix commit explicitly warns of heap buffer overflow and potential kernel crash; corrupted adjacent heap metadata or pointers from the OOB access can trigger oops, panic, or loss of network availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_ppe.c"],"versions":[{"version":"56b99327a451917f1c17f85fc33ea8293c08a9ee","lessThan":"112b5eff24e044561ee9599a0d34e0fcea1df4e0","status":"affected","versionType":"git"},{"version":"6d5b601d52a27aafff555b480e538507901c672c","lessThan":"9f7cd1e26d2f1766438edc9b9254f2c618f9ae98","status":"affected","versionType":"git"},{"version":"6d5b601d52a27aafff555b480e538507901c672c","lessThan":"5c121ee635680c93d7074becf14cfbaac140f80d","status":"affected","versionType":"git"},{"version":"6.18.33","lessThan":"6.18.40","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/airoha/airoha_ppe.c"],"versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.33","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/112b5eff24e044561ee9599a0d34e0fcea1df4e0"},{"url":"https://git.kernel.org/stable/c/9f7cd1e26d2f1766438edc9b9254f2c618f9ae98"},{"url":"https://git.kernel.org/stable/c/5c121ee635680c93d7074becf14cfbaac140f80d"}],"title":"net: airoha: fix foe_check_time allocation size","x_generator":{"engine":"bippy-1.2.0"}}}}