Linux Kernel CVE-2026-80693

Exploitation requires the attacker to control the virtchnl2 control plane the victim idpf driver trusts - specifically a PF or a hypervisor device model that returns a crafted VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds num_allocated_vectors. The victim must be running the idpf driver and going through interrupt-vector register initialization (idpf_intr_reg_init / idpf_get_reg_intr_vecs) at device probe or reset. Limiting factors: the trigger is not reachable by an unprivileged local user or a remote network peer - it demands a malicious or compromised control-plane position (untrusted host, hostile PF, or multi-tenant SR-IOV attacker), the vector is local (AV:L), and only kernels with the idpf driver bound to such a device are affected.

The signals conflict in a way defenders should weigh. The 9.3 CVSS and the AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H vector reflect a low-complexity, high-impact kernel memory corruption with a scope change (a host/PF authority corrupting the guest/VF driver), which is why the score is critical. Against that, EPSS is 0.15% (5th percentile), it is NOT on CISA KEV, and no POC is referenced, so real-world exploitation probability is currently very low. The decisive limiter is the trust model: the malicious input must originate from the control plane (a compromised PF or a hostile hypervisor device model), which is already a highly privileged position. This is therefore a meaningful hardening fix for confidential-computing, untrusted-host, and multi-tenant SR-IOV threat models, but a low operational priority where the hypervisor and PF are trusted. Note the input's PR:N is arguably generous given the required control-plane position; the scope change is what captures the cross-authority nature.

An attacker who controls the control plane - for example a compromised PF, a hostile hypervisor device model, or a malicious host in a confidential-computing scenario - answers the guest idpf driver's VIRTCHNL2_OP_ALLOC_VECTORS request with a reply advertising a small num_allocated_vectors but chunks whose num_vectors sum higher. During idpf_get_reg_intr_vecs(), the driver writes struct idpf_vec_regs entries past the end of the reg_vals kmalloc buffer (KASAN slab-out-of-bounds write), corrupting adjacent kernel heap objects toward denial of service or potential privilege escalation. No POC is referenced in the available data.