CVE-2026-90085: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

rvudbgnixtmtreedisplay() dereferences pfvf->sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF whose transmit queues are not set up triggers a kernel oops.

Guard the read path the same way rvudbgnixtmtreewrite() already does and return -EINVAL with a seqfile message when sqctx is NULL.

Affected Software

1 affected component

Linux Linux kernel

Event History

Sep 17, 2026

CVE Published

via MITRE·04:06 PM

Data Sourced

via MITRE·04:06 PM

Description

Frequently Asked Questions

Who can trigger the kernel oops?

A user or process able to read the octeontx2 NIX TM-tree debugfs file can trigger it when targeting a NIX LF whose transmit queues have not been set up.

Is a normally configured system affected?

The failure requires the octeontx2 debugfs TM-tree read path to be used and a NIX LF without allocated SQ context. Systems that do not expose or read this debugfs entry are not described as triggering the issue.

What happens if the vulnerable file is read?

The kernel dereferences a NULL sq_ctx pointer and oopses. The resolved behavior is to return -EINVAL and emit a seq_file message when sq_ctx is NULL.