CVE-2026-98806: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled
Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized.
This patch adds a NULL check for queuetopfcmap before dereferencing it. Also, simplifies the logic by always assigning a default BPID first, then conditionally overriding it if CONFIGDCB is enabled and the map exists.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the invalid memory access?
The issue affects Linux kernel systems using the octeontx2-pf driver with CONFIG_DCB enabled, specifically when SDP virtual functions are involved. The vulnerable path occurs because queue_to_pfc_map is not initialized for SDP VFs.
What condition is required to trigger the issue?
CONFIG_DCB must be enabled and the driver must process BPID assignment for an SDP VF whose queue_to_pfc_map is NULL. The invalid access results from dereferencing that uninitialized map.
What mitigation is available if the fix cannot be applied immediately?
Disabling CONFIG_DCB avoids the affected conditional BPID-assignment path. Systems that do not use SDP VFs are not identified in the provided information as triggering the uninitialized-map condition.
How does the fix prevent the problem?
The fix checks queue_to_pfc_map for NULL before dereferencing it. It also assigns a default BPID first and only overrides it when CONFIG_DCB is enabled and a map is available.