CVE-2026-80617net: airoha: fix foe_check_time allocation size
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 29, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 56b99327a451917f1c17f85fc33ea8293c08a9ee before 112b5eff24e044561ee9599a0d34e0fcea1df4e0; from 6d5b601d52a27aafff555b480e538507901c672c before 9f7cd1e26d2f1766438edc9b9254f2c618f9ae98; 6d5b601d52a27aafff555b480e538507901c672c builds before 5c121ee635680c93d7074becf14cfbaac140f80d; from 6.18.33 before 6.18.40 | CNA record |
References
- https://git.kernel.org/stable/c/112b5eff24e044561ee9599a0d34e0fcea1df4e0
- https://git.kernel.org/stable/c/9f7cd1e26d2f1766438edc9b9254f2c618f9ae98
- https://git.kernel.org/stable/c/5c121ee635680c93d7074becf14cfbaac140f80d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.