CVE-2026-23180

Vulnerability

Description

In the Linux kernel's dpa2-switch driver, the IRQ handler extracts a 16-bit if_id from the upper bits of a hardware status register and uses it as an index into the ethsw->ports[] array without verifying that the index is within bounds. The array is allocated with sw_attr.num_ifs elements, but if_id can range from 0 to 65535, allowing an attacker to trigger an out-of-bounds read [1].

Exploitation

Scenario

An attacker who can send crafted network frames to the switch or manipulate the hardware status register could cause the IRQ handler to read beyond the allocated array. This does not require local authentication; any network-adjacent attacker capable of triggering the vulnerable code path may exploit this issue.

Impact

Successful exploitation leads to reading kernel memory beyond the ports array, potentially leaking sensitive information or causing system instability. The vulnerability is rated High (CVSS 7.0) due to the potential for information disclosure or denial of service.

Mitigation

A fix has been committed to the stable kernel tree that adds a bounds check before accessing the ports array, consistent with existing validation in the dpaa2_switch_rx() function [1]. Users should apply the kernel update once it reaches their distribution.