CVE-2026-80629

A flaw was found in the Linux kernel's octeontx2-af: npc component. This vulnerability arises from incorrect memory allocation when processing reserved MCAM entries for the CPT 2nd pass, leading to a small out-of-bounds write. An attacker could potentially exploit this memory corruption to cause a system crash, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's OcteonTX2 admin function (octeontx2-af) Network Processor Classifier (NPC) driver. The array that maps MCAM entries to action counters (mcam->entry2cntr_map) was allocated only for the number of non-reserved MCAM entries, but a counter can also be allocated for a reserved MCAM entry, such as the CPT second-pass entry installed during driver initialization. Mapping such a reserved entry writes past the end of the array, resulting in a small (2-byte) slab out-of-bounds write that can corrupt kernel memory and crash the kernel, causing a denial of service. Red Hat rated this flaw Moderate impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering it requires local privileged access on systems using affected Marvell OCTEON TX2 hardware rather than remote network access. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those kernels. The kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10, and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2, are affected; fixes for these releases are currently deferred, and the residual risk is that on affected Marvell OCTEON TX2 systems the out-of-bounds write can still occur when MCAM counters are configured, for example during driver initialization, leading to a kernel crash and denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.