CVE-2026-80617

The Linux kernel's Airoha Ethernet/PPE (packet processing engine) driver allocates the foe_check_time buffer with only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16), creating a heap buffer overflow. When airoha_ppe_foe_verify_entry() processes a flow entry with hash >= ppe_num_entries/2, it writes past the end of the allocation, corrupting kernel heap memory and potentially crashing the kernel; the critical 9.8 CVSS scores network-reachable, unauthenticated attackers at high impact to confidentiality, integrity and availability, though the documented failure mode is a kernel crash. Affected users are operators of Linux-based systems that build in the airoha driver, chiefly Airoha SoC-based boards (e.g., EN7581-class) used in ISP routers and embedded gateways with hardware flow offload. There is no public PoC, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.5%, so no exploitation is currently known.

What to do: Update affected devices to a kernel that includes the fix commit 'net: airoha: fix foe_check_time allocation size' once it reaches your vendor's or the stable kernel branch. As an interim mitigation on Airoha-based routers/gateways, disable hardware flow offload (PPE/NPU offload in the firewall/flowtable configuration) or restrict which peers can reach the device until patched. Check exposure by confirming whether the airoha driver is loaded (e.g., 'lsmod | grep airoha') and whether flowtable offload is enabled.