{"id":"CVE-2026-23180","title":"dpaa2-switch: add bounds check for if_id in IRQ handler","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: add bounds check for if_id in IRQ handler\n\nThe IRQ handler extracts if_id from the upper 16 bits of the hardware\nstatus register and uses it to index into…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 77611cab5bdfff7a070ae574bbfba20a1de99d1b","Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 34b56c16efd61325d80bf1d780d0e176be662f59","Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < f89e33c9c37f0001b730e23b3b05ab7b1ecface2","Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 2447edc367800ba914acf7ddd5d250416b45fb31","Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9","Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 31a7a0bbeb006bac2d9c81a2874825025214b6d8","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:06:42.474268Z"},"published":"2026-02-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:50.196Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23180","references":[{"url":"https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b"},{"url":"https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59"},{"url":"https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2"},{"url":"https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31"},{"url":"https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9"},{"url":"https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8"}],"tags":["cve.org"],"epss":0.00142,"epssPercentile":0.0318,"ingestedAt":"2026-10-16T17:24:46.640Z","slug":"CVE-2026-23180","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: add bounds check for if_id in IRQ handler\n\nThe IRQ handler extracts if_id from the upper 16 bits of the hardware\nstatus register and uses it to index into ethsw->ports[] without\nvalidation. Since if_id can be any 16-bit value (0-65535) but the ports\narray is only allocated with sw_attr.num_ifs elements, this can lead to\nan out-of-bounds read potentially.\n\nAdd a bounds check before accessing the array, consistent with the\nexisting validation in dpaa2_switch_rx().\n\n## Affected\n\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 77611cab5bdfff7a070ae574bbfba20a1de99d1b`\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 34b56c16efd61325d80bf1d780d0e176be662f59`\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < f89e33c9c37f0001b730e23b3b05ab7b1ecface2`\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 2447edc367800ba914acf7ddd5d250416b45fb31`\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9`\n- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 31a7a0bbeb006bac2d9c81a2874825025214b6d8`\n- `Linux 5.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}