CVE-2026-80609: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80609 Overview

CVE-2026-80609 is a vulnerability in the Linux kernel's qede driver, which supports QLogic FastLinQ 4xxxx Ethernet adapters. The flaw involves an out-of-bounds access on the cqe->len_list[] array because the driver accessed an element before validating the index. Maintainers resolved the issue by moving the index check before element access.

The vulnerability affects network packet processing paths in the driver, making it reachable through crafted network traffic delivered to systems using affected QLogic hardware.

Critical Impact
Out-of-bounds array access in the qede network driver can lead to kernel memory corruption, denial of service, or potential code execution through remotely delivered packets processed by affected NICs.

Affected Products

Linux kernel qede driver (QLogic FastLinQ 4xxxx Ethernet controller driver)
Linux kernel stable branches prior to the fix commits listed in the kernel.org references
Systems using QLogic FastLinQ 4xxxx family network adapters with vulnerable kernel versions

Discovery Timeline

2026-08-28 - CVE-2026-80609 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80609

Vulnerability Analysis

The qede driver processes completion queue entries (CQEs) that describe received network packets. Each CQE contains a len_list[] array holding length information for scatter-gather buffer fragments. The vulnerable code accessed an element in cqe->len_list[] before validating that the associated index was within array bounds.

An attacker able to influence CQE contents through crafted network traffic can trigger reads or writes outside the allocated array. In kernel context, out-of-bounds access on adjacent memory can corrupt driver state, leak kernel memory contents, or destabilize the running system.

The upstream fix reorders the logic so the boundary check executes before element dereference. This is a classic [CWE-125] Out-of-Bounds Read or [CWE-787] Out-of-Bounds Write pattern in kernel driver code paths reachable from the network.

Root Cause

The root cause is incorrect ordering of validation and access in the driver's packet handling code. The driver dereferenced an entry from the len_list[] array using an index that had not yet been range-checked against the array size, allowing malformed hardware descriptors or attacker-influenced input to steer reads and writes beyond the buffer.

Attack Vector

The attack vector is network-facing. A remote attacker who can deliver specifically crafted frames to a host with an affected qede-controlled NIC can trigger the out-of-bounds condition during receive processing. Exploitation does not require authentication or user interaction on the target system.

Exploitation code has not been published, and no confirmed in-the-wild activity has been reported. Refer to the Kernel Commit b17751a2 Changes and companion patches for the exact code change.

Detection Methods for CVE-2026-80609

Indicators of Compromise

Unexpected kernel oops or panic messages referencing the qede driver in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports naming qede_rx_process_cqe or len_list on kernels compiled with KASAN
Sudden loss of network connectivity or driver reset events on hosts using QLogic FastLinQ 4xxxx adapters

Detection Strategies

Inventory Linux hosts running the qede module using lsmod | grep qede and cross-reference against the running kernel version and the fixed stable releases
Alert on kernel crash dumps and driver reload events for network drivers on servers exposed to untrusted networks
Monitor for repeated NIC link resets or CQE processing errors that could indicate exploitation attempts

Monitoring Recommendations

Ship kernel logs to a centralized logging or SIEM platform and build detections for qede fault signatures and kernel BUG traces
Track kernel package versions across the fleet and flag hosts running versions predating the fix commits referenced on git.kernel.org
Correlate NIC-level anomalies with north-south network telemetry to identify potentially malicious traffic targeting the driver

How to Mitigate CVE-2026-80609

Immediate Actions Required

Apply the vendor-provided kernel update containing the upstream patches referenced in the NVD entry as soon as testing permits
Prioritize patching for hosts with QLogic FastLinQ 4xxxx NICs that are directly reachable from untrusted networks
Reboot patched systems to load the updated kernel; live-patch tooling may be an option where supported by the distribution

Patch Information

The fix moves the index bounds check before the array element access in the qede receive path. Upstream Linux stable trees have merged the change through multiple backports. Review the following kernel.org commits for the authoritative source changes: Kernel Commit 1aacefd0 Changes, Kernel Commit 6d203bdd Changes, Kernel Commit 6d46ab39 Changes, Kernel Commit b17751a2 Changes, Kernel Commit bd3a6a08 Changes, Kernel Commit e30af53d Changes, and Kernel Commit f9ba47fc Changes. Consult your Linux distribution's security tracker for the specific package version that includes these commits.

Workarounds

On hosts that do not require QLogic FastLinQ 4xxxx connectivity, unload the driver with modprobe -r qede and blacklist the module until patched
Restrict exposure by placing affected hosts behind network segmentation or firewalls that filter untrusted traffic to interfaces bound to the qede driver
Enable kernel hardening features such as KASLR and, where feasible, monitor with KASAN in non-production validation environments to catch exploitation attempts early

bash

# Verify kernel version and qede driver status
uname -r
modinfo qede | grep -E 'filename|version|description'
lsmod | grep qede

# Temporarily unload and blacklist qede where NICs are unused
sudo modprobe -r qede
echo 'blacklist qede' | sudo tee /etc/modprobe.d/blacklist-qede.conf
sudo update-initramfs -u