Cloudanix VulnDB

CVE-2026-80779

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network driver for certain network cards could let a local user crash the machine or gain extra privileges, so the kernel needs to be updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds array access in the ionic driver when the hardware timestamp RX queue index equals nrxqs_per_lif, allowing read past the end of txqcqs[] followed by an invalid write through the derived partner pointer.

Why it matters to the business

Local memory corruption in the network stack can crash systems or enable privilege escalation on servers using Ionic NICs, disrupting network services and requiring urgent kernel updates.

How an attack unfolds

An attacker with local access triggers allocation of the dedicated hwstamp RX queue, then exercises the RX/TX partner assignment or XDP_TX path so the driver indexes one past the normal txqcqs array and corrupts adjacent kernel memory.

How to fix it

Apply the upstream fix that restricts RX/TX partner linking to normal queue-pair indexes only and aborts XDP_TX cleanly for unpaired queues; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the ionic driver source contains the guard that skips partner assignment when q->index equals nrxqs_per_lif and that the XDP_TX path checks for a valid partner before use.

Typical attack path

  1. Obtain local code execution on a host with an Ionic device
  2. Force creation of the hwstamp RX queue (index == nrxqs_per_lif)
  3. Invoke RX partner assignment or XDP_TX on that queue
  4. Trigger out-of-bounds read/write through txqcqs[]
  5. Achieve memory corruption for denial of service or escalation

How to detect it

Inspect kernel logs for ionic driver oops or warnings mentioning txqcqs, partner, or hwstamp; review any recent XDP or timestamp queue activity on hosts with Ionic hardware.

What your security team should do

  • Prioritize kernel upgrade on any system exposing Ionic NICs
  • Restrict unprivileged local access until patches are deployed
  • Monitor for ionic-related kernel oops or crashes as a temporary indicator

The record

In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular queue pairs, so using that index to set rxq->partner can read one entry past txqcqs[] and then write through the derived pointer. Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue has no TX partner.

Affected packages

Ecosystem Package Introduced Fixed