CVE-2026-80779

The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqsperlif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80779.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

8eeed8373e1cca836799bf8e4a05cffa8e444908

Fixed

881a805a8029ba48c0ce81c6674910f8d83f7afb

Fixed

39fc615e355b65b8d43be30da57aa95ae6eaf688

Fixed

f3868046e8e2e761d4d943a232bd109ff22a7d5b

Fixed

ea081b4435515ac7177eb598a3c0678d1b9e7911

Fixed

d92255b405fb6f5acca408239ccd742e0a42c9cb

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80779.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.12.106

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.47

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.1.11

Type: ECOSYSTEM
Events: Introduced

7.2.0

Fixed

7.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80779.json"