Cloudanix VulnDB

CVE-2023-54129

None

CVSS

—

EPSS

0.3%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing check in Linux kernel networking code for certain Marvell chips can make the whole system crash when a network link changes state.

Exploitation
Physical Access
Attacker needs
Physical Access
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing validation of lmac_type_id received from firmware in the octeontx2-af driver allows an invalid identifier to reach strncpy in cgx_link_change_handler, triggering an Oops and kernel panic during physical link change processing.

Why it matters to the business

Systems using affected Marvell CN103XX hardware can experience unexpected kernel crashes triggered by link events, resulting in service interruptions and requiring manual intervention or reboot to recover.

How an attack unfolds

An attacker with the ability to influence firmware-reported link change events supplies an out-of-range lmac_type_id; the unvalidated value is passed to strncpy, causing an invalid memory access and immediate kernel panic on the affected CPU.

How to fix it

Apply the upstream fix by updating the Linux kernel source to commit 83a7f27c5b94e43f29f8216a32790751139aa61e or later; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel tree; exercise link-change paths on supported hardware and verify no panic occurs with deliberately invalid lmac_type_id values.

Typical attack path

  1. Obtain control or spoofing capability over firmware link-change notifications
  2. Trigger a physical link state change that causes firmware to report an invalid lmac_type_id
  3. Kernel handler processes the malformed value without validation
  4. strncpy call in cgx_link_change_handler dereferences invalid data and panics

How to detect it

Search kernel logs for Oops messages containing cgx_link_change_handler and strncpy; inspect workqueue events and pstate registers around the time of any unexpected reboots on affected hardware.

What your security team should do

  • Prioritize kernel upgrade on all Marvell CN103XX-based systems within the next maintenance window
  • Monitor vendor firmware releases for any related lmac_type handling changes
  • Add kernel oops and panic alerts to existing monitoring for early detection of similar driver issues

The record

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.20.0 6.1.32

Related vulnerabilities