CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array
In the Linux kernel, the following vulnerability has been resolved:
idpf: bound interrupt-vector register fill to the allocated array
idpfgetregintrvecs() fills the caller-allocated regvals[] array from the VIRTCHNL2OPALLOCVECTORS reply in adapter->reqvecchunks, bounding its inner loop only by the per-chunk numvectors. The array is sized separately: idpfintrreginit() allocates kzallocobjs(struct idpfvecregs, totalvecs) from caps.numallocatedvectors and only checks the returned count after the fill. The sum of per-chunk numvectors is never reconciled against totalvecs, so a reply with a small numallocatedvectors but chunks summing higher writes past the end of regvals[].
Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2OPALLOCVECTORS reply whose per-chunk numvectors sum exceeds numallocatedvectors writes struct idpfvecregs entries past the end of the regvals kmalloc allocation (KASAN slab-out-of-bounds write).
Bound the fill loop to the array capacity passed in by the callers, mirroring the sibling idpfvportgetqreg(). The existing numregs < numvecs check then rejects an undersized reply without the out-of-bounds write happening first.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel idpf driver are exposed when their PF or hypervisor device model supplies VIRTCHNL2_OP_ALLOC_VECTORS replies to the driver. The issue depends on a reply in which the per-chunk num_vectors total exceeds num_allocated_vectors.
What does an attacker or malicious device need to control?
The control plane must be able to return a crafted VIRTCHNL2_OP_ALLOC_VECTORS response. Specifically, it must report a small num_allocated_vectors while providing chunks whose num_vectors values sum to a larger number.
What is the observable impact of a crafted reply?
The driver can write struct idpf_vec_regs entries beyond the kmalloc-allocated reg_vals array, resulting in a slab out-of-bounds write. KASAN reports this condition as a slab-out-of-bounds write.