Skip to main content

Linux Kernel EUVDEUVD-2026-27768

| CVE-2026-43205 HIGH
Out-of-bounds Write (CWE-787)
2026-05-06 Linux GHSA-v2hq-m36p-4jr3
Buffer Overflow Linux Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Trigger requires control over the firmware-reported num_ifs on specific hardware, so PR:H and AC:H; a successful overflow corrupts kernel memory yielding full C/I/A impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:02 vuln.today
CVSS changed
May 11, 2026 - 20:07 NVD
7.8 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.

The check uses >= because num_ifs == DPSW_MAX_IF is also functionally broken.

build_if_id_bitmap() silently drops any ID >= 64: if (id[i] < DPSW_MAX_IF) bmap[id[i] / 64] |= ...

AnalysisAI

Out-of-bounds write in the Linux kernel's dpaa2-switch driver (NXP DPAA2 Ethernet switch on QorIQ/Layerscape SoCs) allows corruption of a fixed-size 64-entry if_id[] array when the DPSW firmware reports num_ifs >= DPSW_MAX_IF (64). The driver trusted the firmware-supplied interface count from dpsw_get_attributes() without validating it, so dpaa2_switch_fdb_get_flood_cfg() could write port indices - plus the trailing control-interface entry - past the array bounds. EPSS is very low (0.02%, 7th percentile) and there is no public exploit identified at time of analysis; the issue has been fixed upstream and is shipping via Ubuntu USN-8492-1.

Technical ContextAI

The affected component is the DPAA2 (Data Path Acceleration Architecture, 2nd gen) Ethernet switch driver used on NXP/Freescale QorIQ and Layerscape ARM SoCs. The DPSW (Data Path Switch) object exposes attributes through the firmware/Management Complex (MC) via dpsw_get_attributes(), including num_ifs (number of switch interfaces). The driver defines a fixed-size array cfg->if_id[DPSW_MAX_IF] where DPSW_MAX_IF is 64. dpaa2_switch_fdb_get_flood_cfg() iterates over the ports matching a flood filter, writing each index into that array, then appends the control interface (index num_ifs) as one additional entry. Because num_ifs was never bounded, a firmware-reported value of 64 or more lets the loop fill or overrun the array, and the trailing control-interface write overflows by at least one element. This is a classic CWE-787 (Out-of-bounds Write). A related helper, build_if_id_bitmap(), already defensively drops IDs >= DPSW_MAX_IF, which highlights that the flood-cfg path was the missing guard. The fix adds a >= DPSW_MAX_IF bound check on num_ifs in dpaa2_switch_init() (>= is used because num_ifs == 64 is also functionally broken due to the extra control-interface slot).

RemediationAI

Apply the vendor kernel update. Vendor-released patch: upgrade to a fixed stable kernel - 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0 (or later on each branch) - which adds the num_ifs >= DPSW_MAX_IF bound check in dpaa2_switch_init(). Distribution users should install their packaged fix, e.g. via Ubuntu USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1) and equivalent Red Hat/SUSE errata; the corresponding upstream commits are at https://git.kernel.org/stable/c/8b841fd529db9faf8bc678d429d4bf4e98b10900 and the other listed git.kernel.org hashes. If immediate patching is not possible on affected NXP DPAA2 hardware, the specific compensating control is to not load/bind the dpaa2-switch driver (e.g. blacklist the module or avoid configuring the DPSW switch object) - the trade-off is loss of the DPAA2 switch functionality on that platform; on systems that do not use DPAA2 switch hardware there is no practical exposure.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27768 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy