CVE-2026-23070

In the Linux kernel, the following vulnerability has been resolved:

Octeontx2-af: Add proper checks for fwdata

firmware populates MAC address, link modes (supported, advertised) and EEPROM data in shared firmware structure which kernel access via MAC block(CGX/RPM).

Accessing fwdata, on boards booted with out MAC block leading to kernel panics.

Internal error: Oops: 0000000096000005 [#1] SMP [ 10.460721] Modules linked in: [ 10.463779] CPU: 0 UID: 0 PID: 174 Comm: kworker/0:3 Not tainted 6.19.0-rc5-00154-g76ec646abdf7-dirty #3 PREEMPT [ 10.474045] Hardware name: Marvell OcteonTX CN98XX board (DT) [ 10.479793] Workqueue: events work_for_cpu_fn [ 10.484159] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 10.491124] pc : rvu_sdp_init+0x18/0x114 [ 10.495051] lr : rvu_probe+0xe58/0x1d18

A kernel crash can occur in the OcteonTX2 AF driver on boards that boot without the MAC block because the driver may access firmware shared data through rvu fwdata without verifying it is mapped. In that configuration rvu_sdp_init can dereference rvu fwdata unconditionally when checking channel_data valid. This triggers a NULL pointer dereference and panics the kernel during initialization or during later mailbox based operations such as link mode handling. For the CVSS the PR is typically H because triggering the affected paths usually requires administrative control over the device environment and operations like driver probing or privileged net device configuration. The issue is not network reachable and is specific to certain hardware and firmware configurations. Impact is denial of service through a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.