CVE-2026-23180: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23180 is a Linux kernel vulnerability in the dpaa2-switch driver where the IRQ handler fails to validate the if_id value extracted from the upper 16 bits of the hardware status register before using it to index into the ethsw->ports[] array. Since if_id can be any 16-bit value (0–65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read. The vulnerability affects the Linux kernel and was published on February 14, 2026. It carries a CVSS v3.1 base score of 7.0 (High) (Feedly).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in the dpaa2-switch IRQ handler. When a hardware interrupt fires, the handler extracts if_id from the upper 16 bits of the status register and directly uses it as an array index into ethsw->ports[] without verifying that the value is within the allocated range of sw_attr.num_ifs elements. The fix adds a bounds check consistent with the existing validation already present in dpaa2_switch_rx(). Exploitation requires local access with low privileges and has high attack complexity, as it depends on triggering a specific hardware interrupt condition (Feedly).

Successful exploitation can result in high confidentiality, integrity, and availability impacts on the affected system. An out-of-bounds read in kernel space can expose sensitive kernel memory contents, potentially corrupt adjacent memory structures, or cause a kernel panic leading to denial of service. The vulnerability is confined to systems using the DPAA2 (Data Path Acceleration Architecture 2) switch driver, typically found in NXP Layerscape SoC-based platforms (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23180. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been published by Nessus (plugins 299101, 302188, 318847) and Qualys (multiple detection IDs), indicating scanner-level coverage (Feedly).

The fix has been merged into the Linux kernel stable tree via multiple commits (e.g., 1b381a638e18, 31a7a0bbeb00, 34b56c16efd6, 2447edc36780, 77611cab5bdf). Downstream distributions including Debian (DSA-6141-1, DSA-6163-1, DLA-4499-1) and Ubuntu (USN-8393-1) have released updated kernel packages incorporating this fix. Administrators running NXP DPAA2-based systems should apply the latest kernel updates from their distribution as soon as possible (Feedly, Debian LTS).