7

CVE-2026-23180: linux

CVSS: 7.0v3.1HighDeferred
AliasesUBUNTU-CVE-2026-23180DEBIAN-CVE-2026-23180
Published 14-02-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-23180 is a high (CVSS 7.0) vulnerability in linux. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.1% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.0/10
010
High · v3.1 (CVE.org)
EPSS score
0.14%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 15
DLA-4499-1DSA-6141-1DSA-6163-1MGASA-2026-0097MGASA-2026-0098USN-8278-1

Timeline

  1. 14-02-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ handler extracts if_id from the upper 16 bits of the hardware status register and uses it to index into ethsw->ports[] without validation. Since if_id can be any 16-bit value (0-65535) but the ports array is only allocated with sw_attr.num_ifs elements, this can lead to an out-of-bounds read potentially. Add a bounds check before accessing the array, consistent with the existing validation in dpaa2_switch_rx().

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

+0.02 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu145 products
  • linux< 5.15.0-185.195 | < 6.8.0-117.117 | All versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1111.118 | < 6.8.0-1055.58 | All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.164-1 | < 6.12.73-1 | < 6.18.10-1
Linux1 product
  • linux≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < 77611cab5bdfff7a070ae574bbfba20a1de99d1b | ≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < 34b56c16efd61325d80bf1d780d0e176be662f59 | ≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < f89e33c9c37f0001b730e23b3b05ab7b1ecface2 | ≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < 2447edc367800ba914acf7ddd5d250416b45fb31 | ≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < 1b381a638e1851d8cfdfe08ed9cdbec5295b18c9 | ≥ 24ab724f8a4661b2dc8e696b41df93bdc108f7a1, < 31a7a0bbeb006bac2d9c81a2874825025214b6d8 | 5.15

3 vendors · 147 products

References

26 links
Show all 26 references