Executive brief
A memory management vulnerability has been identified in the Linux kernel's network driver for Marvell OcteonTX2 and CN20K hardware. This flaw occurs during the initialization of network queues, where a failure can cause the system to attempt to free the same memory twice. If exploited, this could lead to a system crash or instability, potentially resulting in a denial of service for affected networking hardware.
Technical details
A double-free vulnerability exists in the octeontx2-pf driver within the Linux kernel, specifically in the otx2_pool_aq_init() and cn20k_pool_aq_init() functions. When a mailbox sync or retry allocation fails during Admin Queue (AQ) initialization, the driver frees 'pool->stack' but fails to nullify the pointer. Subsequently, the error handling path in otx2_sq_aura_pool_init() calls otx2_aura_pool_free(), which attempts to free the same 'pool->stack' pointer again. This flaw requires local access and specific Marvell OcteonTX2/CN20K hardware to trigger. Patches have been released to ensure the pointer is set to NULL immediately after the first free operation.
Affected products
- Linux Linux Kernel v6.13-rc1 to v7.1-rc3
Timeline
- 2026-05-30: patched: Fix committed to kernel source
- 2026-07-24: advisory: CVE-2026-64222 published
References
- https://git.kernel.org/stable/c/0488a0bb344fb1992853b60082acff6be8164d74
- https://git.kernel.org/stable/c/0d9b9d7dbef976ae7f855b6358f1d703014e96ea
- https://git.kernel.org/stable/c/4c29603498b05c049dbbbc47e882f2fbf0193cd7
- https://git.kernel.org/stable/c/94192b0579333c3deee2441379aab8ca98fc2e6b
- https://git.kernel.org/stable/c/9b244c242bec48b37e82b89787afd6a4c43457e1
- https://git.kernel.org/stable/c/b92e7ea408b6f1144648909c9c49a55d245d7300
- https://git.kernel.org/stable/c/c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec