CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata
In the Linux kernel, the following vulnerability has been resolved:
Octeontx2-af: Add proper checks for fwdata
firmware populates MAC address, link modes (supported, advertised) and EEPROM data in shared firmware structure which kernel access via MAC block(CGX/RPM).
Accessing fwdata, on boards booted with out MAC block leading to kernel panics.
Internal error: Oops: 0000000096000005 [#1] SMP [ 10.460721] Modules linked in: [ 10.463779] CPU: 0 UID: 0 PID: 174 Comm: kworker/0:3 Not tainted 6.19.0-rc5-00154-g76ec646abdf7-dirty #3 PREEMPT [ 10.474045] Hardware name: Marvell OcteonTX CN98XX board (DT) [ 10.479793] Workqueue: events workforcpufn [ 10.484159] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 10.491124] pc : rvusdpinit+0x18/0x114 [ 10.495051] lr : rvuprobe+0xe58/0x1d18
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.18.8-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.78 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23070?
CVE-2026-23070 is classified as a medium severity vulnerability in the Linux kernel.
What impact does CVE-2026-23070 have on systems?
CVE-2026-23070 can lead to unauthorized access or manipulation of firmware data, affecting system security.
How do I fix CVE-2026-23070?
To fix CVE-2026-23070, update your Linux kernel to the latest version that includes the security patch.
What versions of the Linux kernel are affected by CVE-2026-23070?
CVE-2026-23070 affects various versions of the Linux kernel prior to the implementation of the security patch.
Is there a workaround for CVE-2026-23070?
There are no recommended workarounds for CVE-2026-23070 other than applying the relevant security updates.