CVE-2026-43205

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()

but never validates it against DPSW_MAX_IF (64). This value controls

iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices

into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports

num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for num_ifs in dpaa2_switch_init().

dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port

num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all

ports match the flood filter, the loop fills all 64 slots and the control

interface write overflows by one entry.

The check uses >= because num_ifs == DPSW_MAX_IF is also functionally

broken.

build_if_id_bitmap() silently drops any ID >= 64:

if (id[i] < DPSW_MAX_IF)

bmap[id[i] / 64] |= ...

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References