CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
In the Linux kernel, the following vulnerability has been resolved:
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDPTX path abort cleanly if an RX queue has no TX partner.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel ionic network driver are exposed when the dedicated hardware timestamp RX queue is allocated. The issue is specific to the driver's handling of that hardware timestamp queue rather than normal RX/TX queue pairs.
What condition triggers the out-of-bounds access?
The hardware timestamp RX queue has an index equal to nrxqs_per_lif, while the txqcqs array contains only regular queue pairs. Attempting to assign a TX partner using that index reads past the end of txqcqs[] and can subsequently write through the resulting derived pointer.
How does the fix change behavior for the hardware timestamp RX queue?
The fix pairs RX and TX queues only for normal queue-pair indexes. It leaves the hardware timestamp RX queue without a TX partner, and XDP_TX aborts cleanly when an RX queue has no TX partner.