CVE-2026-43205

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: validate num_ifs to prevent out-of-bounds write

The driver obtains swattr.numifs from firmware via dpswgetattributes() but never validates it against DPSWMAXIF (64). This value controls iteration in dpaa2switchfdbgetfloodcfg(), which writes port indices into the fixed-size cfg->ifid[DPSWMAXIF] array. When firmware reports num_ifs >= 64, the loop can write past the array bounds.

Add a bound check for numifs in dpaa2switch_init().

dpaa2switchfdbgetfloodcfg() appends the control interface (port numifs) after all matched ports. When numifs == DPSWMAX_IF and all ports match the flood filter, the loop fills all 64 slots and the control interface write overflows by one entry.

The check uses >= because numifs == DPSWMAX_IF is also functionally broken.

buildifidbitmap() silently drops any ID >= 64: if (id[i] < DPSWMAX_IF) bmap[id[i] / 64] |= ...