Out-of-bounds write in Linux kernel - CVE-2026-63923

Detailed vulnerability description

The vulnerability allows a local user to cause a denial of service or overwrite out-of-bounds memory.

The vulnerability exists due to an out-of-bounds write in rvu_mbox_handler_rep_event_notify and the representor event handling path when processing a crafted REP_EVENT_NOTIFY mailbox request with a sender-controlled body pcifunc value. A local user can send a specially crafted mailbox request to cause a denial of service or overwrite out-of-bounds memory.

Exploitation requires a VF attached to a PF that has been put into switchdev representor mode. For RVU_EVENT_MAC_ADDR_CHANGE, the invalid body pcifunc is used as a six-byte ether_addr_copy() target in the queued worker.

How to mitigate CVE-2026-63923

Sources

• https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0
• https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138