Executive brief
A memory allocation bug in the Linux kernel's Marvell OcteonTX2 network driver causes the counter mapping array to be undersized, leading to out-of-bounds writes when reserving hardware resources for cryptographic acceleration. This can cause kernel crashes or memory corruption during device initialization.
Technical details
A heap buffer overflow (KASAN-detected slab-out-of-bounds write) in the octeontx2-af NPC (network packet classifier) driver occurs in the npc_mcam_rsrcs_init() function. The entry2cntr_map array is allocated with size mcam->bmap_entries but accessed with indices up to mcam->total_entries, which includes reserved entries for CPT (crypto) pass-2 operations. The fix allocates the array with the correct size (mcam->total_entries) and initializes the full range accordingly. Attack vector is local/internal only, triggered during device initialization. No user authentication required. Patch available in upstream Linux kernel commit f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232.
Affected products
- Linux Linux kernel 6.1.67 and earlier versions with octeontx2 driver
Timeline
- 2026-08-28: disclosed
- 2026-07-24: patched