CVE-2026-93246: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
rvuregisterinterrupts() walks every MSI-X vector and uses strstr() to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector NAMESIZE buffer, but not every slot is populated before this loop runs. strstr() keeps scanning until it finds a NUL terminator, so an uninitialized slot can trigger a KASAN slab-out-of-bounds read at boot when debug options are enabled.
Use strnstr() with NAMESIZE to bound the search within each vector's name buffer.
Affected Software
Event History
Frequently Asked Questions
Under what conditions is this issue likely to be observed?
It can occur during boot in the octeontx2-af driver's interrupt-registration path, when the driver examines MSI-X vector name buffers. The out-of-bounds read is reported as a KASAN slab-out-of-bounds error when debug options are enabled.
What causes the out-of-bounds read?
Not every per-vector irq_name buffer slot is populated before the affinity-setting loop runs. The prior unbounded strstr() call can scan past a NAME_SIZE buffer that lacks a NUL terminator while looking for "Mbox" or "FLR".
What is the remediation?
Apply the available Linux kernel stable fixes referenced for this issue. The fix replaces the unbounded string search with strnstr() limited to NAME_SIZE, preventing searches beyond each vector name buffer.