idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80693 · published 28 Aug 2026
How serious is it
- Severity: critical, CVSS score 9.3 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-80693?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: d4d5587182664b0c4ab6d3556ce881cb975507c2 to < a6447b6a9678e701ca4d32789f311067cf528c2d, d4d5587182664b0c4ab6d3556ce881cb975507c2 to < e299b7d1334ebec4d43a7bb697d10c12df1aaed3, d4d5587182664b0c4ab6d3556ce881cb975507c2 to < 41bb8748124d0d8ee5d8e1eace9dfbc874bc9564, d4d5587182664b0c4ab6d3556ce881cb975507c2 to < 9f7007ee9858c99aa43101bc8352c672fee85644
- Linux Linux: 6.7
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
idpf: bound interrupt-vector register fill to the allocated array
idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding
its inner loop only by the per-chunk num_vectors. The array is sized
separately: idpf_intr_reg_init() allocates
kzalloc_objs(struct idpf_vec_regs, total_vecs) from
caps.num_allocated_vectors and only checks the returned count after the
fill. The sum of per-chunk num_vectors is never reconciled against
total_vecs, so a reply with a small num_allocated_vectors but chunks
summing higher writes past the end of reg_vals[].
Impact: a control plane (a PF or hypervisor device model) that returns a
VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds
num_allocated_vectors writes struct idpf_vec_regs entries past the end of
the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).
Bound the fill loop to the array capacity passed in by the callers,
mirroring the sibling idpf_vport_get_q_reg(). The existing
num_regs < num_vecs check then rejects an undersized reply without the
out-of-bounds write happening first.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/a6447b6a9678e701ca4d32789f311067cf528c2d
- git.kernel.org/stable/c/e299b7d1334ebec4d43a7bb697d10c12df1aaed3
- git.kernel.org/stable/c/41bb8748124d0d8ee5d8e1eace9dfbc874bc9564
- git.kernel.org/stable/c/9f7007ee9858c99aa43101bc8352c672fee85644
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON