---
id: CVE-2026-23180
title: 'dpaa2-switch: add bounds check for if_id in IRQ handler'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpaa2-switch: add bounds check for if_id in IRQ handler

  The IRQ handler extracts if_id from the upper 16 bits of the hardware
  status register and uses it to index into…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    77611cab5bdfff7a070ae574bbfba20a1de99d1b
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    34b56c16efd61325d80bf1d780d0e176be662f59
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    f89e33c9c37f0001b730e23b3b05ab7b1ecface2
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    2447edc367800ba914acf7ddd5d250416b45fb31
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    1b381a638e1851d8cfdfe08ed9cdbec5295b18c9
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    31a7a0bbeb006bac2d9c81a2874825025214b6d8
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:42.474268Z'
published: '2026-02-14'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:50.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23180'
references:
  - url: 'https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b'
  - url: 'https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59'
  - url: 'https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2'
  - url: 'https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31'
  - url: 'https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9'
  - url: 'https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8'
tags:
  - cve.org
epss: 0.00142
epssPercentile: 0.0318
ingestedAt: '2026-10-16T17:24:46.640Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: add bounds check for if_id in IRQ handler

The IRQ handler extracts if_id from the upper 16 bits of the hardware
status register and uses it to index into ethsw->ports[] without
validation. Since if_id can be any 16-bit value (0-65535) but the ports
array is only allocated with sw_attr.num_ifs elements, this can lead to
an out-of-bounds read potentially.

Add a bounds check before accessing the array, consistent with the
existing validation in dpaa2_switch_rx().

## Affected

- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 77611cab5bdfff7a070ae574bbfba20a1de99d1b`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 34b56c16efd61325d80bf1d780d0e176be662f59`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < f89e33c9c37f0001b730e23b3b05ab7b1ecface2`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 2447edc367800ba914acf7ddd5d250416b45fb31`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 31a7a0bbeb006bac2d9c81a2874825025214b6d8`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.