CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: npc: Fix size of entry2cntrmap
KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntrmap is not allocated for reserved entries.
BUG: KASAN: slab-out-of-bounds in npcmapmcamentryandcntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14
CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events workforcpufn Call trace: dumpbacktrace.part.0+0xe4/0xf0 showstack+0x18/0x30 dumpstacklvl+0x88/0xb4 printreport+0x154/0x458 kasanreport+0xb8/0x194 asanstore2+0x7c/0xa0 npcmapmcamentryandcntr+0xb0/0x1a0 rvumboxhandlernpcmcamwriteentry+0x268/0x280 npcinstallflow+0x840/0xfe0 rvunpcinstallcptpass2entry+0x138/0x190 rvunixinit+0x148c/0x2880 rvuprobe+0x1800/0x30b0 localpciprobe+0x78/0xe0 workforcpufn+0x30/0x50 processonework+0x4cc/0x97c workerthread+0x360/0x630 kthread+0x1a0/0x1b0 retfromfork+0x10/0x20
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
octeontx2-af: npcto a version that resolves this vulnerability.Patch octeontx2-af: npc: Fix size of entry2cntr_map - Operational
Rebuild and redeploy the Linux kernel containing the resolved fix for 'octeontx2-af: npc: Fix size of entry2cntr_map' to address the KASAN slab-out-of-bounds in npc_map_mcam_entry_and_cntr (reserved mcam entries / entry2cntr_map sizing).
Event History
Frequently Asked Questions
Which deployments are indicated by the available report?
The report identifies the Linux kernel octeontx2-af NPC code path. The recorded failure occurred on a Marvell CN106XX board during device initialization.
How can I identify this issue in kernel diagnostics?
Look for a KASAN slab-out-of-bounds write in npc_map_mcam_entry_and_cntr. The reported call trace includes rvu_mbox_handler_npc_mcam_write_entry, npc_install_flow, rvu_npc_install_cpt_pass2_entry, rvu_nix_init, and rvu_probe.
Is a fix available?
The vulnerability is described as resolved, and three stable Linux kernel commit references are provided. The supplied data does not identify the kernel versions containing those fixes.