Executive brief
The OcteonTX2 virtual function network driver in the Linux kernel has a race condition during device probe and removal where the network device registration can attempt to use a workqueue before it is initialized. This can cause kernel panics or data corruption during driver initialization or unloading, affecting systems using Marvell OcteonTX2 network interfaces.
Technical details
This is a race condition in the octeontx2 virtual function driver (drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c). The vulnerability occurs because register_netdev() was called before otx2_vf_wq_init(), allowing ndo_set_rx_mode callbacks to queue work on a NULL workqueue during multicast/promiscuous mode operations. The fix reorders initialization so the workqueue is created first, and ensures proper cleanup by unregistering the netdev before destroying the workqueue. Additionally, proper error handling paths were added for the probe function. The attack vector is local (driver initialization/removal) with no network exposure; exploitation requires the ability to trigger device probe/removal or multicast mode changes.
Affected products
- Linux Linux kernel multiple versions (patch applied to stable kernels linux-5.x, linux-6.x, linux-7.x)
Timeline
- 2026-09-17: disclosed: CVE-2026-90084 published
- 2026-08-24: patched: Upstream patch merged