CRITICAL
airoha FoeCheckTime Overflow
CVE-2026-80617
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.
02KernelScan AI Analysis
Risk summary
A heap buffer overflow in the Airoha ethernet PPE driver allows writing beyond an undersized allocation when processing flow offload entries. Local attackers with access to the network interface can trigger memory corruption, potentially leading to privilege escalation or kernel crash.
Vulnerability analysis
The Airoha ethernet PPE driver allocates a buffer for tracking flow entry timestamps using the wrong size, reserving only one byte per entry instead of the two bytes each entry requires. When the driver later writes timestamps for entries in the upper half of the table, it writes past the end of the heap buffer, corrupting adjacent kernel memory. The fix corrects the allocation to use the proper element size. This code path is reachable on systems using Airoha ethernet hardware when the PPE flow offload engine processes network traffic, requiring no special privileges beyond local network access to trigger.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18.33 | 6.18.40 | 112b5eff24e0 |
| mainline | — | 7.2 | 5c121ee63568 |
| 7.1 | — | 7.1.5 | 9f7cd1e26d2f |