CVE-2026-23422CWE-787

CVE-2026-23422

High · published April 3, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler

Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ

handler") introduces a range check for if_id to avoid an out-of-bounds

access. If an out-of-bounds if_id is detected, the interrupt status is

not cleared. This may result in an interrupt storm.

Clear the interrupt status after detecting an out-of-bounds if_id to avoid

the problem.

Found by an experimental AI code review agent at Google.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-04-03T18:16Z
Affected products (14)
ProductVersionsFixed in
linux/linux_kernel≥ 5.15.200, < 5.15.2035.15.203
linux/linux_kernel≥ 6.1.163, < 6.1.1676.1.167
linux/linux_kernel≥ 6.6.124, < 6.6.1306.6.130
linux/linux_kernel≥ 6.12.70, < 6.12.776.12.77
linux/linux_kernel≥ 6.18.10, < 6.18.176.18.17
linux/linux_kernel≥ 6.19.1, < 6.19.76.19.7
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (10)
EPSS history
Timeline
  • 03 APR 13:24Z
    dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
    cvelistv5