octeontx2-af: Add validation for lmac type (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Deferred
Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180
References
- https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73
- https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e
- https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0
- https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb
- https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2023-60316
- GCVE · GCVE-0-2023-54129
CERT-FR advisories
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a < 4392454c694b13d78c84165c0964729772cd3b73 ; affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a < 83a7f27c5b94e43f29f8216a32790751139aa61e ; affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a < afd7660c766c4d317feae004e5cd829390bbc4b0 ; affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a < 5c0268b141ad612b6fca13d3a66cfda111716dbb ; affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a < cb5edce271764524b88b1a6866b3e626686d9a33 |
| Linux · Linux | affected 4.20 ; unaffected 0 < 4.20 ; unaffected 5.10.259 ≤ 5.10.* ; unaffected 6.1.32 ≤ 6.1.* ; unaffected 6.2.16 ≤ 6.2.* ; unaffected 6.3.3 ≤ 6.3.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |