Linux Kernel CVE-2026-43205

The affected component is the DPAA2 (Data Path Acceleration Architecture, 2nd gen) Ethernet switch driver used on NXP/Freescale QorIQ and Layerscape ARM SoCs. The DPSW (Data Path Switch) object exposes attributes through the firmware/Management Complex (MC) via dpsw_get_attributes(), including num_ifs (number of switch interfaces). The driver defines a fixed-size array cfg->if_id[DPSW_MAX_IF] where DPSW_MAX_IF is 64. dpaa2_switch_fdb_get_flood_cfg() iterates over the ports matching a flood filter, writing each index into that array, then appends the control interface (index num_ifs) as one additional entry. Because num_ifs was never bounded, a firmware-reported value of 64 or more lets the loop fill or overrun the array, and the trailing control-interface write overflows by at least one element. This is a classic CWE-787 (Out-of-bounds Write). A related helper, build_if_id_bitmap(), already defensively drops IDs >= DPSW_MAX_IF, which highlights that the flood-cfg path was the missing guard. The fix adds a >= DPSW_MAX_IF bound check on num_ifs in dpaa2_switch_init() (>= is used because num_ifs == 64 is also functionally broken due to the extra control-interface slot).