CVE-2023-52905

What it actually does

The octeontx2-pf driver fails to release allocated mcam entries for Ntuple and hash tables for tc when the VF driver unbinds, resulting in persistent kernel resource leakage.

Why it matters to the business

Repeated driver unbind operations on affected systems can lead to gradual resource exhaustion, causing performance degradation or instability on specialized network hardware over time, with low urgency given the age and low exploit probability.

How an attack unfolds

An attacker with local access triggers repeated VF driver bind/unbind cycles to accumulate unfreed kernel resources; no known threat actors or campaigns have exploited this issue.

How to fix it

Apply the kernel fix containing commit c8ca0ad10df08ea36bcac1288062d567d22604c9; for Android components update to versions released on 2022-12-01 for branches 10, 11, 12, 12L, and 13.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree or verify updated package versions match the 2022-12-01 Android releases and the referenced Linux commit.

Typical attack path

1. Gain local access to a system running the vulnerable octeontx2-pf driver
2. Repeatedly bind and unbind the VF driver to allocate resources without corresponding deallocation

How to detect it

Inspect kernel logs and resource accounting for repeated mcam or tc allocation events without matching frees during driver lifecycle events; correlate with system uptime and driver reload patterns.

What your security team should do

• Apply kernel and Android updates containing the listed fixes on systems using OcteonTX2 hardware
• Review driver unbind handling in test environments before production deployment
• Monitor kernel resource counters for mcam and tc features as an ongoing hygiene measure