EUVD-2026-67493
GHSA-9xc5-vpm2-h2hw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Packet-triggered via Airoha PPE so AV:N, but requires hitting a specific hash bucket (AC:H); fixed-timestamp write gives limited integrity impact (I:L) and DoS-dominant availability impact (A:H), no confidentiality.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: fix foe_check_time allocation size
foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).
When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.
AnalysisAI
Heap buffer overflow in the Linux kernel's Airoha (airoha_eth) network driver allows the packet-processing engine (PPE) flow-offload logic to write past an undersized allocation, corrupting kernel heap memory and crashing affected systems. The bug affects Linux 6.18.x through 6.18.39 and 6.19/7.x pre-release trees on hardware using the Airoha PPE flow-offload driver, and is triggered when airoha_ppe_foe_verify_entry() processes a flow hash at or above half the entry count. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be running the Linux Airoha Ethernet (airoha_eth) driver with the PPE flow-offload engine active - i.e., Airoha-SoC networking hardware, not a general-purpose x86 server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.18.40, 7.1.5, or 7.2, which correct the allocation to ppe_num_entries * sizeof(u16); the stable fixes are commits 112b5eff24e044561ee9599a0d34e0fcea1df4e0, 9f7cd1e26d2f1766438edc9b9254f2c618f9ae98, and 5c121ee635680c93d7074becf14cfbaac140f80d at git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of systems running Linux kernel versions 6.18.x through 6.18.39 or 6.19/7.x pre-release on Airoha-equipped hardware and classify by operational criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today