SB20260626114 - Out-of-bounds read in Linux kernel marvell mvpp2 driver
Published: June 26, 2026
Security Bulletin ID
SB20260626114
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-53217)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a local attacker to disclose sensitive information.
The vulnerability exists due to improper memory synchronization in mvpp2_rx() in the mvpp2 network driver when processing received packets on non-coherent DMA systems. A local attacker can send network traffic that triggers reception of a crafted frame to disclose sensitive information.
Only non-coherent DMA systems are affected.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/180235600934bef6add3be637c296d6cf3272e67
- https://git.kernel.org/stable/c/19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8
- https://git.kernel.org/stable/c/23548007b3c66d628fc7d6b80d1e23be04ea10d9
- https://git.kernel.org/stable/c/60412bdd1b2576659eac23a23d2d9ff96228a643
- https://git.kernel.org/stable/c/a13199fa224e9f776f4005d5037df03aa9ea8f37
- https://git.kernel.org/stable/c/a3ad9b5767c89531fc7dae951b51b0933dcf7051
- https://git.kernel.org/stable/c/bede0f481b9137d73d1cf64309cbe4b94818a5d6
- https://git.kernel.org/stable/c/e302206ad84a407a7e5f3f6fe767ff5efaace689