UBUNTU-CVE-2026-90080: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call sites used testbit() on it unconditionally. Switching to devlink eswitch mode creates representors and runs otx2inithwresources(), which reaches otx2poolaqinit() and oopses when dereferencing the NULL bitmap. Add NULL checks before every afxdpzcqidx testbit() use in the RSS, ethtool, XSK, and pool init paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add NULL checks before every af_xdp_zc_qidx test_bit() use in the RSS, ethtool, XSK, and pool initialization paths, including otx2_pool_aq_init(), to prevent NULL dereferences for representors and other non-AF_XDP paths.
Event History
Frequently Asked Questions
Which deployments are most likely to encounter this issue?
Systems using the octeontx2 PF driver in the listed Ubuntu kernel packages are affected by the vulnerable code path. The documented trigger involves switching devlink eswitch mode, which creates representors; non-AF_XDP representor paths can leave the relevant bitmap unset.
What happens when the vulnerable path is triggered?
The kernel can oops while initializing hardware resources because it dereferences a NULL af_xdp_zc_qidx bitmap. The failing path reaches otx2_pool_aq_init() after representors are created during a devlink eswitch mode change.
What can be done if an update cannot be applied immediately?
Avoid switching devlink eswitch mode or otherwise creating representors on affected systems until the kernel fix is deployed. This avoids the specifically documented trigger path.
How can an administrator recognize a likely occurrence?
A likely occurrence is a kernel oops during or after a devlink eswitch mode transition that creates representors. The affected initialization sequence includes otx2_init_hw_resources() and otx2_pool_aq_init().