Executive brief
A vulnerability was identified in the Linux kernel's Marvell OcteonTX2 network driver. The issue occurs when the system processes network link speed information from hardware firmware; if the firmware reports an unexpected speed value, it could cause the system to access memory outside of its intended boundaries. This could potentially lead to system instability or a crash.
Technical details
An out-of-bounds read vulnerability exists in the Marvell OcteonTX2 Admin Function (AF) driver within the Linux kernel. Specifically, the function `link_status_user_format` in `drivers/net/ethernet/marvell/octeontx2/af/cgx.c` uses the `RESP_LINKSTAT_SPEED` field from firmware to index the `cgx_speed_mbps` array. While the array contains 13 elements, the field can return values up to 15, leading to an out-of-bounds access if the firmware reports a value >= 13. An attacker or a compromised firmware could potentially trigger this to cause a kernel oops or leak small amounts of adjacent kernel memory. The fix introduces a bounds check using `ARRAY_SIZE` and defaults to a speed of 0 for invalid indices.
Affected products
- Linux Linux Kernel 4.20 to 6.6.14
Timeline
- 2026-07-24: advisory: CVE-2026-64225 published by NVD
- 2026-06-01: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/2c3d26b4a62454945ba9ef3af3174d3e40e7afef
- https://git.kernel.org/stable/c/47a4cf2229be379cf88f92e32e1240337cd6273f
- https://git.kernel.org/stable/c/8201bf45cc7c1c1a09290c4db8ab1e19801f8fec
- https://git.kernel.org/stable/c/93d3dc81098cd60fb74d434ba7985ddfd9de5acb
- https://git.kernel.org/stable/c/94071141f00bc414e8f8f7f5db3b5143d535299f
- https://git.kernel.org/stable/c/985b5e38ac4f4d5ff03c8bfd8484353b440a1579
- https://git.kernel.org/stable/c/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542