Executive brief
The Linux kernel's Marvell Octeon Ethernet driver contains a use-after-free vulnerability in device initialization error handling. When device setup fails (e.g., MAC address retrieval), the driver exits without properly canceling background worker tasks, which later execute on freed memory. This can cause kernel crashes or memory corruption.
Technical details
This is a use-after-free vulnerability in the octeon_ep driver's probe error path. The root cause is that if octep_probe fails to retrieve the device's MAC address, it exits while leaving the delayed work task intr_poll_task still queued in the kernel scheduler. When this task later executes, it accesses device memory that has already been freed. The fix moves task cancellation from octep_remove() into octep_device_cleanup(), which is called in both the normal device removal path and the probe error path. The patch also ensures ctrl_mbox_task cancellation follows intr_poll_task cancellation, as the former may be queued by the latter. This is a local kernel memory safety issue affecting the Ethernet device initialization code.
Affected products
- Linux Linux kernel affected versions include kernels containing the octeon_ep driver prior to commit 758c91078165ae641b698750a72eafe7968b3756
Timeline
- 2023-08-10: disclosed: Patch authored by Michal Schmidt
- 2023-08-14: patched: Merged upstream by Jakub Kicinski
- 2025-10-07: advisory: CVE-2023-53638 published