CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array
In the Linux kernel, the following vulnerability has been resolved:
idpf: bound interrupt-vector register fill to the allocated array
idpfgetregintrvecs() fills the caller-allocated regvals[] array from the VIRTCHNL2OPALLOCVECTORS reply in adapter->reqvecchunks, bounding its inner loop only by the per-chunk numvectors. The array is sized separately: idpfintrreginit() allocates kzallocobjs(struct idpfvecregs, totalvecs) from caps.numallocatedvectors and only checks the returned count after the fill. The sum of per-chunk numvectors is never reconciled against totalvecs, so a reply with a small numallocatedvectors but chunks summing higher writes past the end of regvals[].
Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2OPALLOCVECTORS reply whose per-chunk numvectors sum exceeds numallocatedvectors writes struct idpfvecregs entries past the end of the regvals kmalloc allocation (KASAN slab-out-of-bounds write).
Bound the fill loop to the array capacity passed in by the callers, mirroring the sibling idpfvportgetqreg(). The existing numregs < numvecs check then rejects an undersized reply without the out-of-bounds write happening first.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Bound the idpf_get_reg_intr_vecs() fill loop to the reg_vals[] array capacity passed by callers, mirroring idpf_vport_get_q_reg(); ensure writes do not exceed the array allocated from caps.num_allocated_vectors.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel idpf driver are exposed when their PF or hypervisor device model supplies VIRTCHNL2_OP_ALLOC_VECTORS replies to the driver. The issue depends on a reply in which the per-chunk num_vectors total exceeds num_allocated_vectors.
What does an attacker or malicious device need to control?
The control plane must be able to return a crafted VIRTCHNL2_OP_ALLOC_VECTORS response. Specifically, it must report a small num_allocated_vectors while providing chunks whose num_vectors values sum to a larger number.
What is the observable impact of a crafted reply?
The driver can write struct idpf_vec_regs entries beyond the kmalloc-allocated reg_vals array, resulting in a slab out-of-bounds write. KASAN reports this condition as a slab-out-of-bounds write.