CVE record · CVE-2026-80609

qede: fix out-of-bounds check for cqe->len_list[]

CVSS 9.8 CriticalCriticalEPSS 0.0074 · 55th percentile

Critical, because:

CVSS score 9.8: 9.0 or more.

Published by the CVE Program (CNA: Linux) at 28 Aug 2026, 06:48 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected ecbb12caf399d7cf364b7553ed5aebeaa2f255bc to before 6d203bdd227fca1787f8a80cf84b990936633c5a git affected a778912b4a53587ea07d85526d152f85d109cbfe to before bd3a6a083b408e96437dbd86ff543ba9ec3a788b git affected f0923011c1261b33a2ac1de349256d39cb750dd0 to before e30af53dca803893a29eb3bbe0539752ba435410 git affected 917a9d02182ac8b4f25eb47dc02f3ec679608c24 to before 1aacefd074b5dcc99b8dbcd73e1c963ed5010110 git affected 896f1a2493b59beb2b5ccdf990503dbb16cb2256 to before b17751a2ebc4aef3ce6be6f71ee8df92bf5ddfcd git affected 896f1a2493b59beb2b5ccdf990503dbb16cb2256 to before 6d46ab395803f162cdc50e8d346e5f1a4e766771 git affected 896f1a2493b59beb2b5ccdf990503dbb16cb2256 to before f9ba47fce5932c15891c89c60e76dfaca919cb8d git affected e441db07f208184e0466abf44b389a81d70c340e git affected 5.15.197 to before 5.15.212 semver affected 6.1.159 to before 6.1.178 semver affected 6.6.118 to before 6.6.145 semver affected 6.12.60 to before 6.12.97 semver and 1 more Other versions: unaffected
Linux	Linux	affected 6.18 unaffected before 6.18 semver unaffected 5.15.212 to 5.15., inclusive semver unaffected 6.1.178 to 6.1., inclusive semver unaffected 6.6.145 to 6.6., inclusive semver unaffected 6.12.97 to 6.12., inclusive semver unaffected 6.18.40 to 6.18., inclusive semver unaffected 7.1.5 to 7.1., inclusive semver unaffected 7.2 to *, inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-80609
CNA: Linux
Tags: Linux kernel
Published: 28 Aug 2026
Updated: 16 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.8	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CNA (Linux)

CISA KEV Not listed.
EPSS 0.0074, the 55th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 28 Aug 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.