CVE-2026-64224

A flaw was found in the Linux kernel's OcteonTX2 network driver. This flaw can lead to a Denial of Service (DoS) due to a double-free memory issue during error handling. When hardware resource initialization fails during network representor setup, the driver mistakenly releases the same memory resources twice. A local privileged user could potentially trigger this condition, resulting in kernel memory corruption and a system crash.

A double free can occur in the OcteonTX2 representor initialization error path. rvu_rep_rsrc_init allocates queue memory and then calls otx2_init_hw_resources, but if hardware resource setup fails, that helper already unwinds partially initialized SQ, CQ, and aura state before returning an error. The old representor error path could then call otx2_free_hw_resources again and free the same resources a second time, creating a kernel memory corruption candidate and likely crash. For the CVSS the PR:L is used in the paranoid score because a less privileged local service account or delegated device management context may be able to trigger driver recovery or initialization paths in some deployments, although typical systems require administrator privileges. The issue is not network reachable and depends on OcteonTX2 representor hardware plus a failure during hardware resource setup. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to kernel double free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.