CVE-2026-80693: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80693 Overview

CVE-2026-80693 is an out-of-bounds write vulnerability in the Linux kernel's Intel Infrastructure Data Path Function (idpf) network driver. The flaw exists in idpf_get_reg_intr_vecs(), which fills a caller-allocated reg_vals[] array from a VIRTCHNL2_OP_ALLOC_VECTORS reply stored in adapter->req_vec_chunks. The function bounds its inner loop only by per-chunk num_vectors values, never reconciling their sum against the array capacity derived from caps.num_allocated_vectors. A control plane returning chunks whose vector counts sum higher than num_allocated_vectors writes struct idpf_vec_regs entries past the end of the kmalloc allocation.

Critical Impact
A malicious or malformed control plane (PF or hypervisor device model) can trigger a heap out-of-bounds write in the guest or host kernel, enabling privilege escalation or kernel memory corruption.

Affected Products

Linux kernel versions containing the idpf driver prior to the fix commits
Systems using the Intel idpf network driver with virtchnl2 control plane
Virtualized environments where a hypervisor device model supplies VIRTCHNL2_OP_ALLOC_VECTORS replies

Discovery Timeline

2026-08-28 - CVE-2026-80693 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80693

Vulnerability Analysis

The idpf driver processes vector allocation replies from a paravirtualized control plane using the virtchnl2 protocol. Two independent code paths handle the vector data. idpf_intr_reg_init() allocates the reg_vals[] array using kzalloc_objs(struct idpf_vec_regs, total_vecs), where total_vecs derives from caps.num_allocated_vectors. A separate function, idpf_get_reg_intr_vecs(), then iterates over the chunk list in adapter->req_vec_chunks and writes register descriptors into that array.

The fill loop bounds itself only on each chunk's own num_vectors field. It never validates that the running total of written entries stays within the allocated array. The existing num_regs < num_vecs check runs only after the fill completes, so the out-of-bounds write occurs before the size mismatch is detected.

Root Cause

The root cause is missing bounds reconciliation between two producer-consumer contracts. The allocator trusts num_allocated_vectors from the capabilities structure. The fill loop trusts per-chunk num_vectors from the allocation reply. When these values disagree, and the chunk sum is larger, the writer exceeds the allocation. This is a classic Out-of-Bounds Write [CWE-787] pattern where attacker-influenced length metadata is not validated against buffer capacity.

Attack Vector

Exploitation requires a hostile or compromised control plane. In virtualized deployments, a malicious hypervisor device model or a compromised physical function (PF) driver can craft a VIRTCHNL2_OP_ALLOC_VECTORS reply. The reply advertises a small num_allocated_vectors value while including chunks whose num_vectors fields sum higher. When the guest idpf driver processes the reply, idpf_get_reg_intr_vecs() writes struct idpf_vec_regs records past the slab allocation, producing a KASAN slab-out-of-bounds write. The controlled overflow content is register field data derived from the reply, giving the attacker influence over adjacent kernel heap objects.

The upstream fix bounds the fill loop to the array capacity supplied by callers, mirroring the sibling function idpf_vport_get_q_reg(). Refer to the kernel commits 41bb874 and 9f7007e for the patch.

Detection Methods for CVE-2026-80693

Indicators of Compromise

KASAN reports flagging slab-out-of-bounds writes with idpf_get_reg_intr_vecs on the call stack
Kernel oops or panic messages referencing the idpf driver during device probe or reset
Unexpected corruption of adjacent slab objects allocated near struct idpf_vec_regs arrays

Detection Strategies

Enable KASAN on kernels running the idpf driver in test and staging virtualization tiers to surface bounds violations early
Monitor kernel logs for idpf initialization failures, num_regs < num_vecs warnings, and unexpected driver resets
Audit hypervisor device model code paths that emit VIRTCHNL2_OP_ALLOC_VECTORS replies for consistency between num_allocated_vectors and per-chunk vector sums

Monitoring Recommendations

Ingest dmesg and journald kernel logs into a centralized data lake and alert on KASAN and BUG messages containing idpf
Track kernel version inventory across virtualized hosts and guests to identify systems missing the upstream fix
Correlate driver crash telemetry with control-plane firmware or hypervisor updates that may deliver malformed vector replies

How to Mitigate CVE-2026-80693

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits 41bb874 and 9f7007e
Inventory all systems loading the idpf driver, including guest VMs on hypervisors that expose idpf virtual functions
Restrict which control-plane components can deliver virtchnl2 messages to trusted, patched firmware and device models

Patch Information

The fix bounds the fill loop in idpf_get_reg_intr_vecs() to the array capacity passed in by callers. The existing num_regs < num_vecs check then rejects undersized replies without a preceding out-of-bounds write. Patches are available in the mainline and stable trees via Kernel Git Commit 41bb874 and Kernel Git Commit 9f7007e. Distribution vendors ship the fix in their respective kernel security updates.

Workarounds

Unload or blacklist the idpf driver on systems that do not require Intel IPU or E2100-class devices until patched kernels are deployed
Where feasible, run guest workloads on hypervisors and PF drivers from trusted vendors that emit well-formed VIRTCHNL2_OP_ALLOC_VECTORS replies
Enable KASAN in non-production environments to detect exploitation attempts during validation of updates

bash

# Verify whether the idpf driver is loaded and identify running kernel
lsmod | grep idpf
uname -r

# Temporary mitigation: blacklist the idpf module until a patched kernel is installed
echo "blacklist idpf" | sudo tee /etc/modprobe.d/blacklist-idpf.conf
sudo update-initramfs -u