CVE-2026-80609

CVE-2026-80609 is an out-of-bounds array access in the qede network driver of the Linux kernel, which serves QLogic/Marvell FastLinQ 41000/45000-series Ethernet adapters; the defect is an ordering error in which an element of the cqe->len_list[] array was accessed before the index was validated, and the upstream fix moves the index check ahead of the element access. The condition is reached during packet receive (completion queue entry) processing when the index used to read cqe->len_list[] exceeds the array's bounds, which an attacker able to send traffic through a system using the qede driver could potentially trigger. A successful trigger could yield out-of-bounds kernel memory reads (potential information disclosure) and/or a kernel crash causing denial of service; the assigned CVSS 3.1 score of 9.8 (Critical, AV:N/AC:L/PR:N/UI:N, high C/I/A) reflects this network-reachable, no-authentication exposure. Any Linux system running the qede driver is affected; the data does not specify affected or fixed kernel version ranges, so defenders should rely on their distribution's security advisory. Exploitation status is quiet: no public proof of concept is known, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.5% (42nd percentile).

What to do: Apply your distribution's kernel security update containing the qede fix once available (the fixed version number is not specified in this data, so follow the vendor advisory). Check whether the driver is actually in use on your hosts with 'lsmod | grep qede' — only systems with Marvell/QLogic FastLinQ adapters and the module loaded are exposed; until patched, restrict network access to such hosts or unload the module if the adapter is unused.