Executive brief
The Linux kernel's Pensando Ionic network driver incorrectly accessed a transmit queue array beyond its bounds when setting up hardware timestamp receive queues. An attacker with the ability to trigger this code path could read and write arbitrary kernel memory, potentially leading to denial of service or privilege escalation on systems using this driver.
Technical details
The vulnerability is an out-of-bounds (OOB) array access in the Ionic network driver's queue initialization code. The hardware timestamp RX queue is allocated with an index equal to nrxqs_per_lif, but the normal txqcqs array only contains regular queue pairs and is not sized to accommodate this index. When the code unconditionally used this index to set rxq->partner, it could read one entry past the txqcqs[] array bounds and write through the resulting invalid pointer. The fix restricts partner linking to only normal queue-pair indexes and adds bounds checking, leaving the hwstamp RX queue unpaired and making XDP_TX operations safely abort if no TX partner exists.
Affected products
- Linux Linux kernel affected versions include 5.x through 6.x series; fix available in stable branches
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Fix committed upstream and merged into stable trees