GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23180 (GCVE-0-2026-23180)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-08-05 12:20
VLAI
Title
dpaa2-switch: add bounds check for if_id in IRQ handler
Summary
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < 77611cab5bdfff7a070ae574bbfba20a1de99d1b (git)
Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < 34b56c16efd61325d80bf1d780d0e176be662f59 (git)
Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < f89e33c9c37f0001b730e23b3b05ab7b1ecface2 (git)
Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < 2447edc367800ba914acf7ddd5d250416b45fb31 (git)
Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9 (git)
Affected: 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 , < 31a7a0bbeb006bac2d9c81a2874825025214b6d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.200 , ≤ 5.15.* (semver)
Unaffected: 6.1.163 , ≤ 6.1.* (semver)
Unaffected: 6.6.124 , ≤ 6.6.* (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77611cab5bdfff7a070ae574bbfba20a1de99d1b",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            },
            {
              "lessThan": "34b56c16efd61325d80bf1d780d0e176be662f59",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            },
            {
              "lessThan": "f89e33c9c37f0001b730e23b3b05ab7b1ecface2",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            },
            {
              "lessThan": "2447edc367800ba914acf7ddd5d250416b45fb31",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            },
            {
              "lessThan": "1b381a638e1851d8cfdfe08ed9cdbec5295b18c9",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            },
            {
              "lessThan": "31a7a0bbeb006bac2d9c81a2874825025214b6d8",
              "status": "affected",
              "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: add bounds check for if_id in IRQ handler\n\nThe IRQ handler extracts if_id from the upper 16 bits of the hardware\nstatus register and uses it to index into ethsw-\u003eports[] without\nvalidation. Since if_id can be any 16-bit value (0-65535) but the ports\narray is only allocated with sw_attr.num_ifs elements, this can lead to\nan out-of-bounds read potentially.\n\nAdd a bounds check before accessing the array, consistent with the\nexisting validation in dpaa2_switch_rx()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in a hardware IRQ handler for NXP DPAA2 Ethernet switch hardware. The if_id comes from MC firmware via hardware registers, requiring at minimum local access to the system running this hardware. Not remotely triggerable via network packets.\nAC:H - The attacker cannot control the if_id value returned by the MC firmware in the IRQ status register. Triggering an out-of-bounds if_id requires a firmware bug or hardware anomaly, which are conditions beyond the attacker\u0027s control.\nPR:L - While the IRQ fires from hardware events, a local user on a system with DPAA2 hardware could potentially trigger link state change events. No special privileges beyond basic local access are required to cause network interface events.\nUI:N - No user interaction is required. The IRQ handler fires automatically in response to hardware events without any user action.\nS:U - The vulnerability affects the kernel in its own security context. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\nC:H - The OOB read on the heap-allocated ports pointer array (up to 64K entries beyond bounds) reads arbitrary kernel heap memory. The dereferenced pointer then accesses further arbitrary memory, potentially disclosing kernel data.\nI:H - The OOB-read pointer is dereferenced and used to call functions that modify port state (link state update, MAC address set, MAC connect/disconnect). If the OOB-read pointer happens to point to attacker-influenced memory, this could enable arbitrary writes.\nA:H - Dereferencing a garbage pointer read from OOB heap memory will almost certainly cause a kernel crash (oops or panic), resulting in complete denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:30.334Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59"
        },
        {
          "url": "https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8"
        }
      ],
      "title": "dpaa2-switch: add bounds check for if_id in IRQ handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23180",
    "datePublished": "2026-02-14T16:27:11.463Z",
    "dateReserved": "2026-01-13T15:37:45.984Z",
    "dateUpdated": "2026-08-05T12:20:30.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23180",
      "date": "2026-09-18",
      "epss": "0.00126",
      "percentile": "0.02676"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "77611cab5bdfff7a070ae574bbfba20a1de99d1b",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "34b56c16efd61325d80bf1d780d0e176be662f59",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f89e33c9c37f0001b730e23b3b05ab7b1ecface2",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2447edc367800ba914acf7ddd5d250416b45fb31",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b381a638e1851d8cfdfe08ed9cdbec5295b18c9",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "31a7a0bbeb006bac2d9c81a2874825025214b6d8",
                    "status": "affected",
                    "version": "24ab724f8a4661b2dc8e696b41df93bdc108f7a1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.200",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.124",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.70",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: add bounds check for if_id in IRQ handler\n\nThe IRQ handler extracts if_id from the upper 16 bits of the hardware\nstatus register and uses it to index into ethsw-\u003eports[] without\nvalidation. Since if_id can be any 16-bit value (0-65535) but the ports\narray is only allocated with sw_attr.num_ifs elements, this can lead to\nan out-of-bounds read potentially.\n\nAdd a bounds check before accessing the array, consistent with the\nexisting validation in dpaa2_switch_rx()."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndpaa2-switch: a\u00f1adir comprobaci\u00f3n de l\u00edmites para if_id en el manejador IRQ\n\nEl manejador IRQ extrae if_id de los 16 bits superiores del registro de estado del hardware y lo utiliza para indexar en ethsw-\u0026gt;ports[] sin validaci\u00f3n. Dado que if_id puede ser cualquier valor de 16 bits (0-65535) pero el array de puertos solo se asigna con elementos sw_attr.num_ifs, esto puede llevar a una posible lectura fuera de l\u00edmites.\n\nA\u00f1adir una comprobaci\u00f3n de l\u00edmites antes de acceder al array, consistente con la validaci\u00f3n existente en dpaa2_switch_rx()."
          }
        ],
        "id": "CVE-2026-23180",
        "lastModified": "2026-06-17T10:21:02.943",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-02-14T17:15:55.747",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T13:40:55+00:00",
      "cve": "CVE-2026-23180",
      "id": "CVE-2026-23180",
      "initial_release_date": "2026-02-14T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (dpaa2-switch): Out-of-bounds read in IRQ handler due to improper if_id validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23180.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.