« Volver al listado

CVE-2026-80779

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80779",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8eeed8373e1cca836799bf8e4a05cffa8e444908",
              "lessThan": "881a805a8029ba48c0ce81c6674910f8d83f7afb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8eeed8373e1cca836799bf8e4a05cffa8e444908",
              "lessThan": "39fc615e355b65b8d43be30da57aa95ae6eaf688",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8eeed8373e1cca836799bf8e4a05cffa8e444908",
              "lessThan": "f3868046e8e2e761d4d943a232bd109ff22a7d5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8eeed8373e1cca836799bf8e4a05cffa8e444908",
              "lessThan": "ea081b4435515ac7177eb598a3c0678d1b9e7911",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8eeed8373e1cca836799bf8e4a05cffa8e444908",
              "lessThan": "d92255b405fb6f5acca408239ccd742e0a42c9cb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c",
            "drivers/net/ethernet/pensando/ionic/ionic_txrx.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.1",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/pensando/ionic/ionic_lif.c",
            "drivers/net/ethernet/pensando/ionic/ionic_txrx.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:03.607",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/39fc615e355b65b8d43be30da57aa95ae6eaf688",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/881a805a8029ba48c0ce81c6674910f8d83f7afb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d92255b405fb6f5acca408239ccd742e0a42c9cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ea081b4435515ac7177eb598a3c0678d1b9e7911",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f3868046e8e2e761d4d943a232bd109ff22a7d5b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ionic: avoid OOB TX partner lookup for hwstamp RXQ\n\nThe dedicated hardware timestamp RX queue is allocated with q->index\nequal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only\ncontains the regular queue pairs, so using that index to set rxq->partner\ncan read one entry past txqcqs[] and then write through the derived\npointer.\nOnly link RX/TX partners for normal queue-pair indexes. Leave the hwstamp\nRX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue\nhas no TX partner."
    }
  ],
  "lastModified": "2026-09-04T16:18:03.607",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}