CVE-2026-80617

Received Received - Intake

Heap Buffer Overflow in Linux Kernel Airoha Driver

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80617

EUVD

EUVD-2026-67493

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap buffer overflow vulnerability in the Linux kernel's airoha network driver. A u16 pointer named foe_check_time was allocated with insufficient size, leading to out-of-bounds writes when processing certain hash values. This can cause kernel crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's airoha network driver. Detection requires checking kernel logs for crashes or heap corruption related to the airoha_ppe_foe_verify_entry function. Monitor for kernel oops or panics after network activity involving the airoha driver.

Impact Analysis

If exploited, this flaw could crash the affected system by corrupting kernel memory. It may also enable privilege escalation or denial-of-service attacks on systems using the airoha driver.

Compliance Impact

This vulnerability is a heap buffer overflow in the Linux kernel's airoha network driver, which could lead to kernel crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel-level memory corruption issues.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If an update is not immediately available, disable the airoha driver module (airoha) if not in use. For systems using affected hardware, restrict network access to trusted sources until patched.

Hi! I’m here to help you understand CVE-2026-80617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70