CVE-2023-53654

What it actually does

Missing validation of non-contiguous CGX and LMAC identifiers during RVU driver initialization causes out-of-bounds access and kernel panic on systems with CN10K RPM or RPM_USX MAC blocks.

Why it matters to the business

Systems using affected Linux kernel versions on supported Marvell hardware may experience unexpected crashes during boot or driver load, leading to downtime and requiring manual intervention to recover.

How an attack unfolds

An attacker with local access loads or triggers the octeontx2-af driver on hardware exposing non-contiguous LMAC/CGX blocks; the driver indexes structures using sequential IDs without bounds checks, dereferencing invalid memory and triggering a kernel panic.

How to fix it

Update the Linux kernel to the commit e425e2ba933618ee5ec8e4f3eb341efeb6c9ddef or later stable release containing the validation checks for CGX and LMAC identifiers.

How to confirm the fix worked

Confirm the patch is present by inspecting the octeontx2-af driver source for the added contiguity validation before cgx/lmac access; test boot on CN10K hardware and verify absence of panic in dmesg.

Typical attack path

1. Obtain local access or ability to influence kernel module loading on target hardware
2. Trigger RVU driver initialization (boot or explicit modprobe)
3. Driver performs contiguous ID assumption and calls cgx_lmac_read with invalid index
4. Kernel panics due to invalid memory access

How to detect it

Review kernel logs for panic stacks containing cgx_lmac_read or rvu_program_channels during driver initialization; correlate with hardware presence of CN10K RPM blocks.

What your security team should do

• Prioritize kernel update on all systems using octeontx2-af or related Marvell networking hardware
• Monitor for kernel oops or panic logs referencing cgx_lmac_read or rvu_program_channels
• Restrict unprivileged module loading until patched kernels are deployed