Executive brief
The idpf network driver in the Linux kernel contains a buffer overflow vulnerability in how it processes interrupt vector configuration from device firmware. A malicious or misconfigured device firmware could trigger a memory corruption that crashes the kernel or potentially allows code execution with kernel privileges. This affects any system running the idpf driver with untrusted or compromised device firmware.
Technical details
The vulnerability is a buffer out-of-bounds write (CWE-787) in the idpf driver's `idpf_get_reg_intr_vecs()` function. The function fills a caller-allocated `reg_vals[]` array from firmware's VIRTCHNL2_OP_ALLOC_VECTORS reply without properly bounding the write loop to the array capacity. While the array is sized based on `total_vecs`, the firmware reply contains per-chunk `num_vectors` values that are never reconciled against the total allocation. If a firmware response provides chunks whose `num_vectors` sum exceeds `total_vecs`, the function writes past the end of the `reg_vals` kmalloc buffer (detected by KASAN as a slab-out-of-bounds write). The attack vector requires the device or control plane (PF/hypervisor) to send a crafted VIRTCHNL2_OP_ALLOC_VECTORS reply. The fix adds a capacity parameter to bound the fill loop and validate the reply before writing.
Affected products
- Linux Linux kernel 5.x, 6.x, 7.x (affected versions depend on when idpf driver was introduced)
Timeline
- 2026-08-28: disclosed: Published in NVD
- 2026-06-17: patched: Upstream fix commit 9f7007ee9858c99aa43101bc8352c672fee85644
- 2026-07-28: other: Tony Nguyen's tree
- 2026-08-09: other: Stable tree backport commit 41bb8748124d0d8ee5d8e1eace9dfbc874bc9564