---
id: CVE-2026-80693
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  idpf: bound interrupt-vector register fill to the allocated array

  idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
  the VIRTCHNL2_OP_ALLOC_VECT…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  idpf: bound interrupt-vector register fill to the allocated array

  idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
  the VIRTCHNL2_OP_ALLOC_VECT…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d4d5587182664b0c4ab6d3556ce881cb975507c2 <
    e299b7d1334ebec4d43a7bb697d10c12df1aaed3
  - >-
    Linux >= d4d5587182664b0c4ab6d3556ce881cb975507c2 <
    41bb8748124d0d8ee5d8e1eace9dfbc874bc9564
  - >-
    Linux >= d4d5587182664b0c4ab6d3556ce881cb975507c2 <
    9f7007ee9858c99aa43101bc8352c672fee85644
  - Linux 6.7
published: '2026-08-28'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:51.680'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80693'
references:
  - url: 'https://git.kernel.org/stable/c/41bb8748124d0d8ee5d8e1eace9dfbc874bc9564'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9f7007ee9858c99aa43101bc8352c672fee85644'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e299b7d1334ebec4d43a7bb697d10c12df1aaed3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0018
epssPercentile: 0.07016
ingestedAt: '2026-10-15T11:00:41.664Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

idpf: bound interrupt-vector register fill to the allocated array

idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from
the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding
its inner loop only by the per-chunk num_vectors. The array is sized
separately: idpf_intr_reg_init() allocates
kzalloc_objs(struct idpf_vec_regs, total_vecs) from
caps.num_allocated_vectors and only checks the returned count after the
fill. The sum of per-chunk num_vectors is never reconciled against
total_vecs, so a reply with a small num_allocated_vectors but chunks
summing higher writes past the end of reg_vals[].

Impact: a control plane (a PF or hypervisor device model) that returns a
VIRTCHNL2_OP_ALLOC_VECTORS reply whose per-chunk num_vectors sum exceeds
num_allocated_vectors writes struct idpf_vec_regs entries past the end of
the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).

Bound the fill loop to the array capacity passed in by the callers,
mirroring the sibling idpf_vport_get_q_reg(). The existing
num_regs < num_vecs check then rejects an undersized reply without the
out-of-bounds write happening first.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.