CVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved:

idpf: bound interrupt-vector register fill to the allocated array

idpfgetregintrvecs() fills the caller-allocated regvals[] array from the VIRTCHNL2OPALLOCVECTORS reply in adapter->reqvecchunks, bounding its inner loop only by the per-chunk numvectors. The array is sized separately: idpfintrreginit() allocates kzallocobjs(struct idpfvecregs, totalvecs) from caps.numallocatedvectors and only checks the returned count after the fill. The sum of per-chunk numvectors is never reconciled against totalvecs, so a reply with a small numallocatedvectors but chunks summing higher writes past the end of reg_vals[].

Impact: a control plane (a PF or hypervisor device model) that returns a VIRTCHNL2OPALLOCVECTORS reply whose per-chunk numvectors sum exceeds numallocatedvectors writes struct idpfvecregs entries past the end of the reg_vals kmalloc allocation (KASAN slab-out-of-bounds write).

Bound the fill loop to the array capacity passed in by the callers, mirroring the sibling idpfvportgetqreg(). The existing numregs < numvecs check then rejects an undersized reply without the out-of-bounds write happening first.