Executive brief
The Linux kernel's Prestera network driver is used to manage certain Marvell network interface cards in servers and network equipment. The driver failed to validate firmware image size before parsing its header, allowing a malformed or truncated firmware image to cause memory access errors or kernel crashes when loaded.
Technical details
This is a bounds-check bypass vulnerability in prestera_fw_hdr_parse() within the Prestera PCI driver (drivers/net/ethernet/marvell/prestera/prestera_pci.c). The function read the firmware header structure without first verifying that the firmware binary (fw->bin) was large enough to contain a complete prestera_fw_header structure. An attacker with the ability to supply or intercept a firmware image could provide a truncated image shorter than sizeof(prestera_fw_header) bytes, causing out-of-bounds memory access when the code attempted to read magic and version fields. The fix adds a simple length check (if fw->bin->size < sizeof(*hdr)) before dereferencing the header pointer. Attack vector requires local or administrative access to load firmware.
Affected products
- Linux Linux kernel versions prior to fix commit 8ae344eb540af3f457179b52bc6061416752485c
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Upstream patch merged; stable tree backports followed