HIGH Introduced in 6.9
ionic HwstampRXQ OOB
CVE-2026-80779
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.
02KernelScan AI Analysis
Risk summary
The ionic network driver's hardware timestamp RX queue uses an index that exceeds the bounds of the TX queue array, causing an out-of-bounds read and subsequent write through a derived pointer. A local attacker with access to the network interface could trigger this during queue initialization, potentially leading to memory corruption.
Vulnerability analysis
The ionic network driver allocates a dedicated hardware timestamp RX queue with an index equal to the number of regular RX queues. When linking RX queues to their TX partners, the code uses this index to look up the TX queue array, which only contains entries for regular queue pairs. For the hardware timestamp queue, this reads one entry past the end of the array and then writes through the resulting pointer, corrupting adjacent memory. The fix adds a bounds check so only normal queue-pair indexes are linked, leaving the hardware timestamp RX queue unpaired, and makes the XDP transmit path abort cleanly if an RX queue has no TX partner. This is reachable locally on systems with an ionic network interface when the driver initializes its queues, requiring no special privileges beyond access to the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.9 | 6.12.106 | 881a805a8029 |
| 6.18 | 6.9 | 6.18.47 | 39fc615e355b |
| mainline | 6.9 | 7.3-rc1 | d92255b405fb |
| 7.2 | 6.9 | 7.2.1 | ea081b443551 |
| 7.1 | 6.9 | 7.1.11 | f3868046e8e2 |
| cip/6.12 | 6.9 | 6.12.108-cip31 | 881a805a8029 |