Executive brief
A vulnerability in the Linux kernel's Marvell OcteonTX2 network driver could allow a system crash. When the hardware firmware sends an unexpected identifier during a network link change, the system fails to validate it, leading to a kernel panic. This results in a complete loss of availability for the affected system.
Technical details
A vulnerability exists in the octeontx2-af driver within the Linux kernel due to missing validation of the lmac_type_id field received from firmware. During a physical link change event, the cgx_link_change_handler processes firmware-reported data; if the firmware returns an invalid lmac_type_id, the kernel attempts to use it as an index for the cgx_lmactype_string array. This results in an out-of-bounds access and a subsequent kernel panic (Oops). The issue is resolved by adding bounds checking against LMAC_MODE_MAX before accessing the string array.
Affected products
- Linux Linux 4.20 to 6.1.32, 6.2.16, 6.3.3
Timeline
- 2023-05-17: patched: Fix committed to stable branches
- 2025-12-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73
- https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb
- https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e
- https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0
- https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33