---
id: CVE-2026-23180
title: 'dpaa2-switch: add bounds check for if_id in IRQ handler'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  dpaa2-switch: add bounds check for if_id in IRQ handler

  The IRQ handler extracts if_id from the upper 16 bits of the hardware
  status register and uses it to index into…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1285
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    77611cab5bdfff7a070ae574bbfba20a1de99d1b
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    34b56c16efd61325d80bf1d780d0e176be662f59
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    f89e33c9c37f0001b730e23b3b05ab7b1ecface2
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    2447edc367800ba914acf7ddd5d250416b45fb31
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    1b381a638e1851d8cfdfe08ed9cdbec5295b18c9
  - >-
    Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 <
    31a7a0bbeb006bac2d9c81a2874825025214b6d8
  - Linux 5.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:42.474268Z'
published: '2026-02-14'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:34.438Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23180'
references:
  - url: 'https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b'
  - url: 'https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59'
  - url: 'https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2'
  - url: 'https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31'
  - url: 'https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9'
  - url: 'https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23180.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-23180'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2439884'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-23180'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23180'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026021429-CVE-2026-23180-19a8@gregkh/T
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00143
epssPercentile: 0.03573
scores:
  cna: 7
  vendor: 5
ingestedAt: '2026-10-16T17:24:46.640Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: add bounds check for if_id in IRQ handler

The IRQ handler extracts if_id from the upper 16 bits of the hardware
status register and uses it to index into ethsw->ports[] without
validation. Since if_id can be any 16-bit value (0-65535) but the ports
array is only allocated with sw_attr.num_ifs elements, this can lead to
an out-of-bounds read potentially.

Add a bounds check before accessing the array, consistent with the
existing validation in dpaa2_switch_rx().

## Affected

- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 77611cab5bdfff7a070ae574bbfba20a1de99d1b`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 34b56c16efd61325d80bf1d780d0e176be662f59`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < f89e33c9c37f0001b730e23b3b05ab7b1ecface2`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 2447edc367800ba914acf7ddd5d250416b45fb31`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9`
- `Linux >= 24ab724f8a4661b2dc8e696b41df93bdc108f7a1 < 31a7a0bbeb006bac2d9c81a2874825025214b6d8`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23180.json)