Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array… (CVE-2026-80693)

The Linux kernel idpf driver had a vulnerability where the function idpf_get_reg_intr_vecs() filled a caller-allocated array reg_vals[] based on per-chunk num_vectors without verifying that the sum of these vectors did not exceed the total allocated vectors. This caused a KASAN slab-out-of-bounds write when the sum of per-chunk num_vectors exceeded the total allocated vectors, leading to memory corruption. The fix bounds the fill loop to the array capacity passed by the caller, preventing out-of-bounds writes and rejecting undersized replies safely.

An attacker controlling the control plane (such as a PF or hypervisor device model) could exploit this vulnerability by sending a crafted VIRTCHNL2_OP_ALLOC_VECTORS reply with per-chunk num_vectors summing to more than the allocated vectors. This results in a kernel out-of-bounds write, potentially causing denial of service or escalation of privileges due to memory corruption. The CVSS score of 9.3 indicates high severity with impact on confidentiality, integrity, and availability.

A fix has been implemented in the Linux kernel to bound the fill loop to the allocated array size, preventing out-of-bounds writes. Users should apply the official kernel updates that include this patch. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are specified.