Executive brief
The Linux kernel contains a null pointer dereference vulnerability in the OcteontX2 network adapter driver's debugfs debug interface. An attacker with local access can trigger a kernel crash (denial of service) by reading a specific debugfs file when transmit queues are not initialized.
Technical details
A null pointer dereference exists in the rvu_dbg_nix_tm_tree_display() function within the OcteontX2 AF driver. The function dereferences the pfvf->sq_ctx pointer without checking whether the SQ (Send Queue) context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree when transmit queues are not set up triggers a kernel oops. The vulnerability requires local access to the debugfs filesystem (typically restricted to root or privileged users). The fix adds a NULL check on sq_ctx before dereferencing it, mirroring the protection already present in the corresponding write path function.
Affected products
- Linux Linux kernel multiple kernel versions through 6.x
Timeline
- 2026-09-17: disclosed
- 2026-08-24: patched: fix merged upstream