CVE-2026-23180

A flaw was found in the Linux kernel's dpaa2-switch component. The Interrupt Request (IRQ) handler improperly validates the 'if_id' value extracted from the hardware status register before using it to access an internal array. This lack of validation allows an attacker to provide an 'if_id' that can lead to an out-of-bounds read. This vulnerability could result in information disclosure, data corruption, or a denial of service.

A moderate-severity flaw was found in the Linux kernel's dpaa2-switch driver. The interrupt (IRQ) handler extracts the if_id value from the upper 16 bits of the hardware status register and uses it to index the ethsw->ports[] array without first validating it against the number of ports allocated for the switch (sw_attr.num_ifs). Because if_id can be any 16-bit value (0-65535) while the ports array is only sized for sw_attr.num_ifs entries, an if_id value beyond the array bounds results in an out-of-bounds read, potentially causing information disclosure, data corruption, or a denial of service (system crash). Exposure is limited to systems using the affected dpaa2-switch networking driver.

Red Hat Enterprise Linux 6, 7, 8, and 9 (including the Real Time kernel packages) are not affected because the vulnerable code is not present in those streams. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix for these products is deferred to a future planned update rather than an immediate z-stream fix. Until a fixed kernel is delivered, the residual risk on affected products is an out-of-bounds read in the dpaa2-switch IRQ handler, which requires the dpaa2-switch driver and its networking hardware to be in use.

The upstream CVE record rates this flaw as important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), while Red Hat rates it as moderate with a CVSS 3.1 score of 5.0, reflecting Red Hat's assessment of high attack complexity and low confidentiality, integrity, and availability impact for this driver-specific issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the dpaa2_switch kernel module from loading. Create /etc/modprobe.d/dpaa2_switch.conf with the following content: install dpaa2_switch /bin/true After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact network functionality if dpaa2-switch hardware is in use.