Cloudanix VulnDB

CVE-2026-80629

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a network driver for certain Marvell chips could let the system write data where it shouldn't in memory, risking crashes or security issues until the kernel is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write of size 2 into slab memory in npc_map_mcam_entry_and_cntr because entry2cntr_map is sized only for non-reserved MCAM entries while code still attempts to store a counter mapping for a reserved CPT second-pass entry.

Why it matters to the business

Kernel memory corruption on affected Marvell OcteonTX2 systems can cause crashes, denial of service, or potential local privilege escalation during driver initialization or flow programming.

How an attack unfolds

An attacker with the ability to trigger MCAM entry installation for a reserved CPT second-pass entry (via rvu_npc_install_cpt_pass2_entry during rvu_nix_init or mbox handler) causes the kernel to write past the allocated map buffer, resulting in KASAN-detected slab corruption.

How to fix it

Apply the upstream fix that correctly sizes entry2cntr_map to include reserved MCAM entries; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the npc_map_mcam_entry_and_cntr function for proper map allocation covering reserved entries and verify no KASAN splats occur during rvu_probe and CPT flow setup on target hardware.

Typical attack path

  1. Load or probe the octeontx2-af driver on affected hardware
  2. Trigger CPT second-pass flow installation path
  3. Call rvu_mbox_handler_npc_mcam_write_entry for a reserved MCAM entry
  4. Execute npc_map_mcam_entry_and_cntr which performs the out-of-bounds store

How to detect it

Search kernel logs for KASAN slab-out-of-bounds reports mentioning npc_map_mcam_entry_and_cntr, rvu_mbox_handler_npc_mcam_write_entry, or rvu_npc_install_cpt_pass2_entry during boot or CPT initialization.

What your security team should do

  • Prioritize patching kernel on all Marvell CN106XX and OcteonTX2 platforms within standard change windows
  • Monitor for KASAN reports or slab corruption during driver load in test and production environments
  • Restrict unprivileged access to interfaces that could indirectly trigger MCAM programming until patched

The record

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries. BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14 CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events work_for_cpu_fn Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x88/0xb4 print_report+0x154/0x458 kasan_report+0xb8/0x194 __asan_store2+0x7c/0xa0 npc_map_mcam_entry_and_cntr+0xb0/0x1a0 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280 npc_install_flow+0x840/0xfe0 rvu_npc_install_cpt_pass2_entry+0x138/0x190 rvu_nix_init+0x148c/0x2880 rvu_probe+0x1800/0x30b0 local_pci_probe+0x78/0xe0 work_for_cpu_fn+0x30/0x50 process_one_work+0x4cc/0x97c worker_thread+0x360/0x630 kthread+0x1a0/0x1b0 ret_from_fork+0x10/0x20

Affected packages

Ecosystem Package Introduced Fixed