CVE-2023-53654

A bounds-checking error was found in the Linux kernel Marvell OcteonTX2 network driver's initialization code. On systems with newer CN10K RPM or CN10KB RPM_USX hardware, a local user with privileges to initialize the driver can trigger driver probe, causing the driver to make incorrect assumptions about hardware topology and access Coherent Global Interconnect eXchange blocks and Logical MAC interfaces using invalid array indices, which leads to out-of-bounds memory access and denial of service through kernel panic.

The driver assumed contiguous CGX/LMAC IDs, so reads/writes to disabled or non-existent LMAC registers could occur during RVU init, leading to a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the octeontx2_af module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.