Junglewise Threat Intelligence

CVE-2026-43157: Linux Kernel Marvell OcteonTX2 memory leak in CGX driver

CVE-2026-43157 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A memory leak vulnerability exists in the Linux kernel's Marvell OcteonTX2 network driver. This driver is used to manage high-performance network interfaces in specific server hardware. An attacker with local access could repeatedly trigger driver operations to exhaust system memory, potentially leading to a system crash or service outage.

Technical details

A memory leak (CWE-401) exists in the octeontx2-af driver, specifically within the CGX (Cloud Gateway Xpress) component. The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap) are allocated during initialization in cgx_lmac_init() but are not released during the teardown process in cgx_lmac_exit(). This vulnerability is reachable via local administrative actions such as unbinding and rebinding the driver. Repeated execution of these operations causes cumulative memory consumption (kmemleak), which can eventually lead to a denial-of-service condition due to kernel memory exhaustion. Patches have been released across multiple stable kernel branches (5.15.y, 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 6.19.y).

Affected products

  • Linux Linux Kernel 5.18 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-02-06: patched: Initial patch authored by Bo Sun
  • 2026-05-06: disclosed: CVE published by kernel.org
  • 2026-05-06: advisory

References

Related threats