CVE-2026-90080: octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup
afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call sites used testbit() on it unconditionally.
Switching to devlink eswitch mode creates representors and runs otx2inithwresources(), which reaches otx2poolaqinit() and oopses when dereferencing the NULL bitmap. Add NULL checks before every afxdpzcqidx testbit() use in the RSS, ethtool, XSK, and pool init paths.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel octeontx2-pf driver are exposed when they create representors or otherwise enter non-AF_XDP paths where the AF_XDP zero-copy queue bitmap was not allocated.
What action triggers the failure?
Switching the devlink eswitch mode creates representors and invokes hardware resource initialization. That initialization can reach the pool setup path and dereference the NULL bitmap, causing an oops.
Is AF_XDP zero-copy required to trigger the problem?
No. The issue occurs because representors and other non-AF_XDP paths leave af_xdp_zc_qidx NULL, while affected code called test_bit() without first checking the pointer.
What does the fix change?
The fix adds NULL checks before uses of af_xdp_zc_qidx in RSS, ethtool, XSK, and pool initialization paths.