CVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved:

idpf: bound interrupt-vector register fill to the allocated array

idpf get reg intr vecs() fills the caller-allocated reg vals[] array from the VIRTCHNL2 OP ALLOC VECTORS reply in adapter->req vec chunks, bounding its inner loop only by the per-chunk num vectors. The array is sized separately: idpf intr reg init() allocates kzalloc objs(struct idpf vec regs, total vecs) from caps.num allocated vectors and only checks the returned count after the fill. The sum of per-chunk num vectors is never reconciled against total vecs, so a reply with a small num allocated vectors but chunks summing higher writes past the end of reg vals[].

Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2 OP ALLOC VECTORS reply whose per-chunk num vectors sum exceeds num allocated vectors writes struct idpf vec regs entries past the end of the reg vals kmalloc allocation (KASAN slab-out-of-bounds write).

Bound the fill loop to the array capacity passed in by the callers, mirroring the sibling idpf vport get q reg(). The existing num regs < num vecs check then rejects an undersized reply without the out-of-bounds write happening first.