CVE-2026-80693

In the Linux kernel idpf driver , idpf_get_reg_intr_vecs() fills a caller-allocated reg_vals[] array using a loop bounded only by per-chunk num_vectors from a VIRTCHNL2_OP_ALLOC_VECTORS reply. The array is sized from caps.num_allocated_vectors, but the sum of per-chunk num_vectors is never reconc...