Description

In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foe_check_time allocation size foe_check_time is declared as u16 pointer but was allocated with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16). When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2, it writes beyond the allocated buffer, causing heap buffer overflow and potential kernel crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:45.723Z",
  "pubdate": "2026-08-28T08:16:45.723Z",
  "executiveSummary": "This vulnerability is a heap-based buffer overflow identified within the Airoha Ethernet driver in the Linux kernel.\nThe flaw originates from an incorrect memory allocation size calculation for the 'foe_check_time' pointer, which is incorrectly sized based on the number of entries rather than the byte-size of the underlying data type (u16).\nAn attacker capable of triggering specific packet processing workflows can induce an out-of-bounds write operation by passing a hash value that exceeds half of the allocated entry count.\nThe impact of this vulnerability includes potential kernel memory corruption, which may lead to system instability, denial-of-service (DoS) via kernel panic, or potentially arbitrary code execution depending on the state of the heap allocator.\nNo specific authentication is mentioned as a prerequisite, implying that if the interface is reachable, exploitation may be possible via crafted network traffic.\nThe risk is considered significant as it pertains to fundamental memory safety within a network driver component.",
  "technicalDetails": "The root cause of this vulnerability is an integer-based mismatch in the memory allocation logic within the airoha network driver's hardware flow offload (PPE) subsystem.\nSpecifically, the variable 'foe_check_time' is defined as a pointer to a 'u16' type, requiring two bytes of memory per entry. However, the allocation routine incorrectly invokes 'kzalloc(ppe_num_entries, ...)', which allocates memory based on the total number of entries rather than the total size of the required buffer (ppe_num_entries * sizeof(u16)).\nThis results in a buffer that is effectively 50% smaller than the required size to hold the intended data structures.\nThe vulnerability is exposed when the 'airoha_ppe_foe_verify_entry()' function processes a flow entry. When this function receives a 'hash' parameter where 'hash >= ppe_num_entries / 2', the array index calculation points to an address outside the bounds of the original heap allocation.\nThe attack flow proceeds as follows: 1) An attacker initiates network traffic or triggers flow offloading operations that invoke 'airoha_ppe_foe_verify_entry'. 2) The attacker ensures the hash calculation results in an index value that addresses memory beyond the allocated buffer size. 3) The kernel attempts to write a u16 value to the offset calculated as 'foe_check_time + (hash * sizeof(u16))'. 4) Due to the undersized allocation, this write lands in adjacent heap memory, overwriting metadata or adjacent kernel objects.\nThe potential impact includes heap grooming or corruption of sensitive kernel data structures located in the vicinity of the 'foe_check_time' buffer. Because this occurs in the kernel context during network packet processing, the exploitability depends on the kernel's memory layout and the presence of adjacent structures that the attacker can influence. A successful overflow will almost certainly trigger a kernel panic due to corrupting memory management structures, resulting in a denial-of-service, or allow for controlled modification of function pointers or object headers if the environment allows for heap spraying techniques."
}