CVE-2026-80779None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The nor…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.
Linux >= 8eeed8373e1cca836799bf8e4a05cffa8e444908 < 881a805a8029ba48c0ce81c6674910f8d83f7afbLinux >= 8eeed8373e1cca836799bf8e4a05cffa8e444908 < 39fc615e355b65b8d43be30da57aa95ae6eaf688Linux >= 8eeed8373e1cca836799bf8e4a05cffa8e444908 < f3868046e8e2e761d4d943a232bd109ff22a7d5bLinux >= 8eeed8373e1cca836799bf8e4a05cffa8e444908 < ea081b4435515ac7177eb598a3c0678d1b9e7911Linux >= 8eeed8373e1cca836799bf8e4a05cffa8e444908 < d92255b405fb6f5acca408239ccd742e0a42c9cbLinux 6.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98770Noneusb: gadget: midi2: Fix the jack descriptor array sizes
CVE-2026-98769Noneusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
CVE-2026-98774Nonerust_binder: cancel deferred work items in thread exit
CVE-2026-98772NoneUSB: serial: fix port tear down use-after-free
CVE-2026-98771Noneusb: storage: sierra_ms: reject short SWoC info transfers
CVE-2026-98776Nonebinderfs: fix UAF write in binder_add_device