CVE-2026-80617: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80617 Overview

CVE-2026-80617 is a heap buffer overflow in the Linux kernel's Airoha network driver. The flaw resides in the foe_check_time buffer allocation logic within the Packet Processing Engine (PPE) subsystem. The buffer is declared as a u16 pointer but allocated with only ppe_num_entries bytes rather than ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is invoked with a hash value greater than or equal to ppe_num_entries/2, the driver writes past the allocated region. The condition corrupts adjacent heap memory and can trigger a kernel crash. The vulnerability is network-reachable and requires no authentication or user interaction.

Critical Impact
Remote attackers can trigger kernel heap corruption in Airoha-based networking hardware, leading to denial of service and potential code execution in kernel context.

Affected Products

Linux kernel versions containing the Airoha PPE driver with the flawed foe_check_time allocation
Networking devices using Airoha SoC-based Ethernet controllers
Distributions shipping affected kernel builds prior to the upstream fix

Discovery Timeline

2026-08-28 - CVE-2026-80617 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80617

Vulnerability Analysis

The vulnerability originates in the Airoha PPE flow offload engine. The driver maintains a per-entry timestamp array named foe_check_time used to track flow verification timing. This array is declared as a pointer to u16 (16-bit unsigned integer) values, meaning each element occupies two bytes.

The allocation in the affected code path sizes the buffer using ppe_num_entries alone. This produces a region half the size required to hold ppe_num_entries 16-bit values. Any index at or beyond ppe_num_entries/2 writes past the allocated region into adjacent slab memory.

The function airoha_ppe_foe_verify_entry() receives a hash parameter derived from network flow attributes. When hash reaches the upper half of the entry table, the write corrupts neighboring kernel heap objects. Depending on the slab layout, this results in a kernel oops, a use-after-free chain, or attacker-controlled write primitives.

Root Cause

The root cause is a missing sizeof(u16) multiplier in the memory allocation call. The developer treated the entry count as a byte count rather than an element count. This classic sizing error [CWE-131] produces a buffer that is exactly half of the required size for a u16 array.

Attack Vector

Exploitation requires reaching the flow verification path over the network. Because PPE hardware offload processes packets automatically, an attacker who can send crafted network traffic to an affected device can control the hash distribution and force writes into the out-of-bounds range. No authentication or local access is required.

The vulnerability is described in prose only; refer to the upstream kernel fix for the exact change.

Detection Methods for CVE-2026-80617

Indicators of Compromise

Unexpected kernel oops or panic messages referencing airoha_ppe_foe_verify_entry or foe_check_time in dmesg
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds writes in the Airoha PPE driver
Sudden network interface resets or PPE offload engine restarts on Airoha-based hardware

Detection Strategies

Enable KASAN in test kernels to catch the out-of-bounds write during fuzzing or regression runs
Monitor dmesg and kernel log aggregation for slab corruption warnings tied to the Airoha driver
Correlate device crashes with concurrent bursts of network flows that exercise a broad hash space

Monitoring Recommendations

Ship kernel logs from Airoha-based devices to a central log platform and alert on Oops, BUG, or KASAN entries
Track PPE offload counters and interface flap events for statistical anomalies
Baseline flow table utilization and alert when hash occupancy crosses ppe_num_entries/2

How to Mitigate CVE-2026-80617

Immediate Actions Required

Apply the upstream Linux kernel patch that corrects the foe_check_time allocation size
Rebuild and deploy vendor kernels for Airoha-based networking hardware
Restrict untrusted network exposure of affected devices until patched

Patch Information

The fix is committed upstream and available in the stable tree. Review the Kernel Git Commit Fix, the Kernel Git Commit Change, and the Kernel Git Commit Update. The patch multiplies ppe_num_entries by sizeof(u16) in the allocation call, sizing the buffer correctly for a u16 array.

Workarounds

Disable PPE hardware offload on Airoha devices where the driver exposes a toggle
Segment affected devices from untrusted networks using upstream firewalls
Reduce ppe_num_entries in device configuration if the driver allows, to keep hash values below the overflow threshold

bash

# Verify running kernel version and inspect Airoha driver messages
uname -r
dmesg | grep -iE 'airoha|foe_check_time'