Critical severity · published Aug 28, 2026
CVE-2026-80617
net: airoha: fix foe_check_time allocation size
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
56b99327a451917f1c17f85fc33ea8293c08a9ee before 112b5eff24e044561ee9599a0d34e0fcea1df4e0; 6d5b601d52a27aafff555b480e538507901c672c before 9f7cd1e26d2f1766438edc9b9254f2c618f9ae98; 6d5b601d52a27aafff555b480e538507901c672c before 5c121ee635680c93d7074becf14cfbaac140f80d; 6.18.33 before 6.18.40; 6.19 · source: vendor
Affected product
LI
Linux
Linux
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place