CVE-2026-63923
Received Received - Intake

Buffer Overflow in OcteonTX2 AF Kernel Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mailbox device index without any bounds check. A VF attached to a PF that has been put into switchdev representor mode reaches this path: the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message id including MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF dispatcher rewrites only msg->pcifunc, leaving struct rep_event::pcifunc attacker-controlled. The sibling rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc is not rvu->rep_pcifunc; this handler has no equivalent gate. An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE, turns into a six-byte attacker-chosen OOB ether_addr_copy() target inside the queued worker; KASAN reports a slab-out-of-bounds write in rvu_rep_wq_handler. Reject malformed requests at the handler entry by gating on is_pf_func_valid(), which is already the canonical PF/VF range check in this driver; expose it via rvu.h so callers in rvu_rep.c can use it instead of open-coding the same range arithmetic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63923
EUVD
EUVD-2026-45696

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
marvell octeontx2 *
marvell octeontx2 *-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the Marvell OcteonTX2 driver where a function processes a user-controlled field without proper validation. The issue allows an attacker to trigger an out-of-bounds write in kernel memory by sending a malformed message through a virtual function (VF) mailbox. The vulnerability stems from missing bounds checks on the pcifunc field in REP_EVENT_NOTIFY requests, leading to potential memory corruption.

Detection Guidance

This vulnerability requires kernel-level detection. Check if your Linux kernel version includes the vulnerable octeontx2-af driver code. Use uname -a to verify kernel version and grep for the affected driver in /lib/modules/$(uname -r)/kernel/drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.ko. If present, inspect system logs for slab-out-of-bounds errors or KASAN reports.

Impact Analysis

This vulnerability could allow an attacker with access to a vulnerable system to execute arbitrary code in the kernel, escalate privileges, or cause a denial-of-service condition. Systems using Marvell OcteonTX2 network adapters with switchdev representor mode enabled are particularly at risk.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's octeontx2-af driver, which could lead to memory corruption or arbitrary code execution. Such flaws may impact compliance with standards like GDPR or HIPAA by compromising system integrity, potentially leading to unauthorized data access or processing. However, specific compliance impacts depend on deployment context and are not detailed in the provided CVE data.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-63923. The vulnerability affects the octeontx2-af driver, so ensure the driver is updated as part of the kernel update. Monitor for any unusual network activity or crashes that may indicate exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart