What is the CVSS score of CVE-2026-80609?

CVE-2026-80609 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-80609?

Within 24 hours, identify and inventory all Linux systems using QLogic FastLinQ or QL4xxx Ethernet adapters, documenting their current kernel versions. Within 7 days, obtain and validate the vendor-released patch in a test environment for affected kernel branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18). Within 30 days, deploy patched kernel versions to all affected production systems, prioritizing externally-facing infrastructure and high-availability environments.

Linux Kernel CVE-2026-80609

EUVD-2026-67485 CRITICAL

2026-08-28 Linux

GHSA-rxrh-5g8p-wjx5

Buffer Overflow Linux

Critical

Disputed · 9.8 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach qede-driven NIC RX path
Delivery

Deliver crafted/malformed completion entry
Exploit

Trigger unchecked len_list[] index access
Execution

Out-of-bounds kernel read
Impact

Kernel panic / potential memory disclosure

Vulnerability Assessment

Exploitation Conditions	Requires the target to be running the Linux qede driver, i.e., a system equipped with Marvell/QLogic FastLinQ (QL4xxx/45xxx) Ethernet hardware with the module loaded - systems without that NIC are not exploitable regardless of the network CVSS vector. Exploitation depends on producing a completion-queue entry whose index reaches the unchecked len_list[] access in the RX path; the CVSS vector claims no authentication or user interaction (PR:N/UI:N), but the practical trigger is bounded to the NIC's descriptor/completion processing rather than an arbitrary remote service, which is the key limiting factor on real-world reach.
Impact	The signals conflict sharply. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) is the automated maximal-severity score typical of bulk Linux CVE assignments and almost certainly overstates real risk: the bug is a bounds-check ordering error in a specific NIC driver's completion-queue handling, whose most plausible outcome is an out-of-bounds read causing a crash/DoS rather than reliable remote code execution. Corroborating this, EPSS is very low (0.17%, 7th percentile), there is no CISA KEV listing, and no public PoC. Exploitation also requires the qede driver to be loaded, i.e., presence of QLogic FastLinQ hardware, which drastically narrows the affected population versus 'all Linux.' Net: treat as a routine kernel-driver hardening fix to roll in via normal stable-kernel updates, not an emergency - the 9.8 should be read skeptically against the low EPSS and hardware-specific attack surface.
Exploit ScenarioDerived	An attacker able to influence traffic or descriptor state processed by a qede-driven QLogic NIC induces a completion-queue entry with an index that drives access beyond cqe->len_list[], causing the driver to read out of bounds and likely panic the kernel (denial of service). No public PoC exists, and reliably escalating the out-of-bounds access to code execution is uncertain and would require additional primitives.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Out-of-bounds memory access in the Linux kernel's qede network driver (QLogic FastLinQ/QL4xxx Ethernet) occurs because the driver reads into cqe->len_list[] before validating the index, allowing a crafted or malformed completion-queue entry to trigger reads past the array bounds. The flaw affects multiple stable branches (5.15, 6.1, 6.6, 6.12, 6.17/6.18) on systems that load the qede driver, with a vendor fix that reorders the bounds check before element access. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

RemediationAI

Vendor-released patch: upgrade to the fixed stable release for your branch - 5.15.212, 6.1.178, 6.6.145, 6.12.97, or 6.18.40 (development fixes in 7.1.5/7.2), which reorder the len_list[] bounds check before element access; apply via your distribution's kernel update. The corresponding upstream commits are available at git.kernel.org/stable/c/6d203bdd227fca1787f8a80cf84b990936633c5a and the sibling backport commits listed in the references. If you cannot patch immediately and do not use QLogic FastLinQ hardware, you can reduce exposure by ensuring the qede module is not loaded (blacklist qede via modprobe), which fully removes the vulnerable code path but disables those NICs - only viable where that hardware is unused. Track advisory detail at https://nvd.nist.gov/vuln/detail/CVE-2026-80609.

Affected VersionsENISA

Linux patch: 6.12.97

Linux patch: 7.2

Linux 6.6.118 <6.6.145

Linux 6.12.60 <6.12.97

Linux patch: 7.1.5

Linux 6.1.159 <6.1.178

Linux 6.18

Linux f0923011c1261b33a2ac1de349256d39cb750dd0 <e30af53dca803893a29eb3bbe0539752ba435410

Linux patch: 6.1.178

Linux 917a9d02182ac8b4f25eb47dc02f3ec679608c24 <1aacefd074b5dcc99b8dbcd73e1c963ed5010110

Linux patch: 0

Linux 896f1a2493b59beb2b5ccdf990503dbb16cb2256 <6d46ab395803f162cdc50e8d346e5f1a4e766771

Linux a778912b4a53587ea07d85526d152f85d109cbfe <bd3a6a083b408e96437dbd86ff543ba9ec3a788b

Linux ecbb12caf399d7cf364b7553ed5aebeaa2f255bc <6d203bdd227fca1787f8a80cf84b990936633c5a

Linux patch: 6.6.145

Linux 5.15.197 <5.15.212

Linux 896f1a2493b59beb2b5ccdf990503dbb16cb2256 <f9ba47fce5932c15891c89c60e76dfaca919cb8d

Linux e441db07f208184e0466abf44b389a81d70c340e

Linux patch: 6.18.40

Linux 6.17.10 <6.18

Linux patch: 5.15.212

Linux 896f1a2493b59beb2b5ccdf990503dbb16cb2256 <b17751a2ebc4aef3ce6be6f71ee8df92bf5ddfcd

Affected Packages

euvd linux fix: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is qede, the mainline Linux driver for Marvell/QLogic FastLinQ (QL4xxx/45xxx) 10/25/40/100G Ethernet adapters. During RX processing the driver walks a completion-queue entry (CQE) and indexes into the len_list[] array; the original code performed the array element access before verifying the index was within bounds, an out-of-bounds access classic to CWE-125 (out-of-bounds read) / CWE-787-adjacent buffer issues (the vendor tags this 'Buffer Overflow'; the CVE record lists CWE as N/A). The fix simply moves the index bounds check ahead of the element dereference. Because CQEs are populated in response to network/DMA activity handled by the NIC, the trigger surface is packet/descriptor processing in the driver's hot path rather than a userspace syscall interface.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.5 MEDIUM

Triggering a specific out-of-bounds CQE index in a hardware-specific driver path warrants AC:H; most plausible impact is crash (A:H) with possible limited memory read (C:L), not integrity loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE CRITICAL

Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 29, 2026 - 07:22 NVD

9.8 (CRITICAL)

Patch available

Aug 28, 2026 - 09:02 EUVD

CVE Published

Aug 28, 2026 - 06:48 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 06:48 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

qede: fix out-of-bounds check for cqe->len_list[]

Move index check before element access.

Executive ViewAI

Why It Matters

A critical-severity vulnerability in Linux systems using QLogic FastLinQ Ethernet adapters could trigger kernel crashes or memory-corruption attacks, affecting organizations dependent on this specific network hardware. Exploitation likelihood is exceptionally low (EPSS 0.17% percentile with no public exploits), reducing immediate operational urgency. Organizations without QLogic FastLinQ cards are unaffected and require no remediation.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Medium

qede driver loads only with QLogic FastLinQ NICs, not all Linux hosts

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80609 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/396543 REF https://git.kernel.org/stable/c/1aacefd074b5dcc99b8dbcd73e1c963ed5010110 REF https://git.kernel.org/stable/c/6d203bdd227fca1787f8a80cf84b990936633c5a REF https://git.kernel.org/stable/c/6d46ab395803f162cdc50e8d346e5f1a4e766771 REF https://git.kernel.org/stable/c/b17751a2ebc4aef3ce6be6f71ee8df92bf5ddfcd REF https://git.kernel.org/stable/c/bd3a6a083b408e96437dbd86ff543ba9ec3a788b REF https://git.kernel.org/stable/c/e30af53dca803893a29eb3bbe0539752ba435410 REF https://git.kernel.org/stable/c/f9ba47fce5932c15891c89c60e76dfaca919cb8d

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back