CVE-2026-80617

A flaw was found in the Linux kernel's net: airoha driver. An incorrect memory allocation size for the foe_check_time array can lead to a heap buffer overflow. When the airoha_ppe_foe_verify_entry() function is called with a specific hash value, it writes beyond the intended buffer. This out-of-bounds write can cause a kernel crash, resulting in a Denial of Service (DoS).

This Linux kernel flaw, rated Moderate by Red Hat, does not affect any shipped Red Hat product. In the airoha Ethernet PPE driver, the foe_check_time array, declared as a pointer to u16, was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() runs with a hash index of ppe_num_entries/2 or greater, it writes beyond the end of the undersized heap buffer, which can crash the kernel and cause a denial of service. The airoha driver supports Airoha Ethernet SoC hardware that is not part of any Red Hat Enterprise Linux or Red Hat In-Vehicle OS release, and the vulnerable code is not present in the shipped kernel, kernel-rt, and kernel-ivos-qualcomm components, so all Red Hat product relationships are recorded as not affected. The upstream CVE record assigns a Critical severity (CVSS 9.8, network attack vector), which differs from Red Hat's Moderate rating (CVSS 5.5, local vector) because the affected driver is not compiled into Red Hat kernels and the verified consequence on hardware where it is used is a kernel crash affecting availability only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.