Executive brief
A vulnerability was identified in the Linux kernel's Marvell Octeon network driver that could cause a system crash. Under conditions of high memory pressure, the driver fails to verify if a memory allocation for incoming network data was successful before using it. This can lead to a kernel panic (system crash), resulting in a denial of service for the affected system.
Technical details
A NULL pointer dereference vulnerability exists in the octeon_ep_vf driver within the __octep_vf_oq_process_rx() function. The root cause is a missing NULL check for the return value of napi_build_skb(), which can return NULL upon allocation failure. This occurs in both the single-buffer and multi-fragment processing paths. An attacker could potentially trigger this condition by flooding the interface with traffic during periods of high system memory pressure, leading to a kernel oops or panic. The fix introduces proper NULL checks and ensures that descriptors are correctly advanced and fragments consumed even when allocation fails. Patches have been backported to several stable kernel branches.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.8, 6.9
Timeline
- 2026-04-09: disclosed: Initial patch submission
- 2026-05-28: advisory: CVE published in NVD