Executive brief
The Linux kernel's octeontx2 network adapter driver has a memory management defect in its mailbox initialization code that causes memory leaks and potential use-after-free conditions. When mailbox initialization is performed multiple times (during device probe and SR-IOV enablement), allocated memory is not properly tracked or freed, leaving stale pointers to freed memory that remain in use during operation. This can result in system crashes or data corruption on affected Marvell OcteonTX2 hardware.
Technical details
This is a memory management vulnerability in the octeontx2 adapter firmware driver. The rvu_mbox_init() function is called twice during device initialization—once for AF-PF mailboxes during probe and again for AF-VF mailboxes during SR-IOV enablement. The vulnerability involves: (1) pointer overwriting causing memory leaks when ng_rvu allocation is repeated without freeing the previous allocation, (2) improper error unwinding that frees resources even when only one initialization path should be cleaned up, and (3) missing DMA memory cleanup in error paths, leaving cleanup only in the device removal path. The fix allocates the ng_rvu structure once using devm_kzalloc() to leverage automatic cleanup, adds selective teardown for individual mailbox types, and ensures DMA memory is freed from both error paths. This is not a remotely exploitable vulnerability but rather a kernel memory management defect that can cause denial of service through resource exhaustion or memory corruption.
Affected products
- Linux Linux kernel Affected versions include at least Linux 5.x–6.x stable branches; the fix was merged in 2026-08-24
Timeline
- 2026-09-17: disclosed
- 2026-08-24: patched