PT-2026-61240 · Linux · Linux
CVE-2026-63923
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
8.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: validate body pcifunc in rvu mbox handler rep event notify
rvu mbox handler rep event notify() in drivers/net/ethernet/marvell/
octeontx2/af/rvu rep.c queues a sender-controlled REP EVENT NOTIFY
request body verbatim, and rvu rep up notify() then forwards
event->pcifunc (the nested body field, distinct from the
AF-normalised header pcifunc) into rvu get pfvf(), rvu get pf() and
the AF->PF mailbox device index without any bounds check.
A VF attached to a PF that has been put into switchdev
representor mode reaches this path: the VF mailbox handler
otx2 pfvf mbox handler() forwards every message id including
MBOX MSG REP EVENT NOTIFY to AF without an allowlist, and the AF
dispatcher rewrites only msg->pcifunc, leaving struct
rep event::pcifunc attacker-controlled. The sibling
rvu mbox handler esw cfg() refuses requests whose header pcifunc
is not rvu->rep pcifunc; this handler has no equivalent gate.
An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[]
element past the allocated array and, for RVU EVENT MAC ADDR CHANGE,
turns into a six-byte attacker-chosen OOB ether addr copy() target
inside the queued worker; KASAN reports a slab-out-of-bounds write
in rvu rep wq handler.
Reject malformed requests at the handler entry by gating on
is pf func valid(), which is already the canonical PF/VF range check
in this driver; expose it via rvu.h so callers in rvu rep.c can use
it instead of open-coding the same range arithmetic.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux