CVE-2026-80609

A flaw was found in the qede driver of the Linux kernel. An out-of-bounds read vulnerability exists due to an incorrect index check for cqe->len_list[] before element access. This flaw could potentially allow an attacker to cause a denial of service or disclose sensitive information.

An out of bounds read in the qede TPA receive path can occur because cqe len_list is read before the loop checks that the index is within ARRAY_SIZE. A remote sender may be able to influence the RX aggregation path by sending traffic that reaches a host using the qede driver with TPA enabled, although reliable triggering depends on NIC firmware behavior and CQE generation. For the CVSS the PR:N is used because no local account on the victim is required if the vulnerable network interface is reachable by the attacker. The issue is network reachable through received Ethernet traffic rather than through a local device interface. Impact is at least denial of service via kernel crash. In the paranoid interpretation, limited confidentiality or integrity impact is kept possible because an out of bounds value is consumed by later skb fragment handling, but the patch does not show an arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.