CVE-2026-23422 dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
An attacker can cause a denial of service via an interrupt storm in the dpaa2-switch driver by triggering an out-of-bounds interface ID.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23422?
CVE-2026-23422 is a high-severity denial of service vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
Commit 31a7a0bbeb00 ("dpaa2-switch: add bounds check for if_id in IRQ handler") introduces a range check for if_id to avoid an out-of-bounds access. If an out-of-bounds if_id is detected, the interrupt status is not cleared. This may result in an interrupt storm.
Clear the interrupt status after detecting an out-of-bounds if_id to avoid the problem.
Found by an experimental AI code review agent at Google.
Weakness: CWE-787
Which versions are affected by CVE-2026-23422?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23422?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23422 being exploited?
There is no known exploitation of CVE-2026-23422 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23422, DEBIAN-CVE-2026-23422, GHSA-6rph-vpvq-7wvw, ROOT-OS-DEBIAN-12-CVE-2026-23422, ROOT-OS-DEBIAN-13-CVE-2026-23422, UBUNTU-CVE-2026-23422.