CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: validate numifs to prevent out-of-bounds write
The driver obtains swattr.numifs from firmware via dpswgetattributes() but never validates it against DPSWMAXIF (64). This value controls iteration in dpaa2switchfdbgetfloodcfg(), which writes port indices into the fixed-size cfg->ifid[DPSWMAXIF] array. When firmware reports numifs >= 64, the loop can write past the array bounds.
Add a bound check for numifs in dpaa2switchinit().
dpaa2switchfdbgetfloodcfg() appends the control interface (port numifs) after all matched ports. When numifs == DPSWMAXIF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.
The check uses >= because numifs == DPSWMAXIF is also functionally broken.
buildifidbitmap() silently drops any ID >= 64: if (id[i] < DPSWMAXIF) bmap[id[i] / 64] |= ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add a bound check for num_ifs in dpaa2_switch_init(), rejecting values >= DPSW_MAX_IF before they are used by the driver.