SB20260720313 - Out-of-bounds write in Linux kernel octeontx2 af driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-63923)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or overwrite out-of-bounds memory.

The vulnerability exists due to an out-of-bounds write in rvu_mbox_handler_rep_event_notify and the representor event handling path when processing a crafted REP_EVENT_NOTIFY mailbox request with a sender-controlled body pcifunc value. A local user can send a specially crafted mailbox request to cause a denial of service or overwrite out-of-bounds memory.

Exploitation requires a VF attached to a PF that has been put into switchdev representor mode. For RVU_EVENT_MAC_ADDR_CHANGE, the invalid body pcifunc is used as a six-byte ether_addr_copy() target in the queued worker.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0
• https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138