GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63923 (GCVE-0-2026-63923)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and the AF->PF mailbox device index without any bounds check. A VF attached to a PF that has been put into switchdev representor mode reaches this path: the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message id including MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF dispatcher rewrites only msg->pcifunc, leaving struct rep_event::pcifunc attacker-controlled. The sibling rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc is not rvu->rep_pcifunc; this handler has no equivalent gate. An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[] element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE, turns into a six-byte attacker-chosen OOB ether_addr_copy() target inside the queued worker; KASAN reports a slab-out-of-bounds write in rvu_rep_wq_handler. Reject malformed requests at the handler entry by gating on is_pf_func_valid(), which is already the canonical PF/VF range check in this driver; expose it via rvu.h so callers in rvu_rep.c can use it instead of open-coding the same range arithmetic.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b8fea84a0468404fe3b3327ad54d583950be9dec , < 4467fa514482bbce82f73788943c815f3d126ab3 (git)
Affected: b8fea84a0468404fe3b3327ad54d583950be9dec , < 68be0260e2a02ff9b18a8678d5f8d1715fa20138 (git)
Affected: b8fea84a0468404fe3b3327ad54d583950be9dec , < 2156a29aecfffa2eb7c558255690084efbe9f3b0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4467fa514482bbce82f73788943c815f3d126ab3",
              "status": "affected",
              "version": "b8fea84a0468404fe3b3327ad54d583950be9dec",
              "versionType": "git"
            },
            {
              "lessThan": "68be0260e2a02ff9b18a8678d5f8d1715fa20138",
              "status": "affected",
              "version": "b8fea84a0468404fe3b3327ad54d583950be9dec",
              "versionType": "git"
            },
            {
              "lessThan": "2156a29aecfffa2eb7c558255690084efbe9f3b0",
              "status": "affected",
              "version": "b8fea84a0468404fe3b3327ad54d583950be9dec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify\n\nrvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/\nocteontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY\nrequest body verbatim, and rvu_rep_up_notify() then forwards\nevent-\u003epcifunc (the nested body field, distinct from the\nAF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and\nthe AF-\u003ePF mailbox device index without any bounds check.\n\nA VF attached to a PF that has been put into switchdev\nrepresentor mode reaches this path: the VF mailbox handler\notx2_pfvf_mbox_handler() forwards every message id including\nMBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF\ndispatcher rewrites only msg-\u003epcifunc, leaving struct\nrep_event::pcifunc attacker-controlled.  The sibling\nrvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc\nis not rvu-\u003erep_pcifunc; this handler has no equivalent gate.\n\nAn out-of-range body pcifunc selects an \u0026rvu-\u003epf[]/\u0026rvu-\u003ehwvf[]\nelement past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE,\nturns into a six-byte attacker-chosen OOB ether_addr_copy() target\ninside the queued worker; KASAN reports a slab-out-of-bounds write\nin rvu_rep_wq_handler.\n\nReject malformed requests at the handler entry by gating on\nis_pf_func_valid(), which is already the canonical PF/VF range check\nin this driver; expose it via rvu.h so callers in rvu_rep.c can use\nit instead of open-coding the same range arithmetic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the OcteonTX2 VF\u2192PF\u2192AF PCI mailbox control path, not through packet reception or any network protocol. Exploitation requires local access to an assigned SR-IOV VF device on a Marvell OCTEONTX2/CN9K/CN10K NIC.\nAC:L - Once a VF is assigned in switchdev representor mode, the attacker fully controls the malicious `rep_event` body fields (including `pcifunc`, event flags, and MAC data) and can trigger the path deterministically via repeated mailbox messages without races or uncontrollable timing.\nPR:L - Exploitation requires control of an assigned VF (typical cloud/tenant VM or container with SR-IOV passthrough), not host root; the PF mailbox forwarder passes every VF message ID including `MBOX_MSG_REP_EVENT_NOTIFY` to AF without an allowlist or trusted-VF gate on this path.\nUI:N - No victim user action (mounting, clicking, opening files) is required; the attacker triggers the vulnerable handler directly by sending a crafted mailbox message from their VF.\nS:C - In the highest-impact deployment (SR-IOV VF assigned to an untrusted VM/container tenant), corruption occurs in the host AF driver, crossing the guest/host security boundary analogous to device-mediated VM escape rather than a same-authority local privilege change.\nC:H - An out-of-range body `pcifunc` makes `rvu_get_pfvf()` return a pointer past the allocated `rvu-\u003epf[]`/`rvu-\u003ehwvf[]` arrays, and the slab-out-of-bounds write corrupts adjacent kernel heap memory in a way that can be leveraged for arbitrary kernel memory disclosure.\nI:H - For `RVU_EVENT_MAC_ADDR_CHANGE`, the worker performs a six-byte attacker-chosen `ether_addr_copy()` to an out-of-bounds `rvu_pfvf` target, constituting an exploitable out-of-bounds kernel heap write suitable for control-flow or privilege-escalation primitives.\nA:H - The out-of-bounds heap write in `rvu_rep_wq_handler` can trigger a kernel oops/panic (as confirmed by KASAN slab-out-of-bounds reports) and can be repeated on demand to deny service to the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:18.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4467fa514482bbce82f73788943c815f3d126ab3"
        },
        {
          "url": "https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138"
        },
        {
          "url": "https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0"
        }
      ],
      "title": "octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63923",
    "datePublished": "2026-07-19T14:55:24.985Z",
    "dateReserved": "2026-07-19T07:54:57.021Z",
    "dateUpdated": "2026-08-05T12:37:18.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63923",
      "date": "2026-09-15",
      "epss": "0.00166",
      "percentile": "0.06212"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63923\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:10.560\",\"lastModified\":\"2026-08-03T10:16:32.130\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify\\n\\nrvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/\\nocteontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY\\nrequest body verbatim, and rvu_rep_up_notify() then forwards\\nevent-\u003epcifunc (the nested body field, distinct from the\\nAF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and\\nthe AF-\u003ePF mailbox device index without any bounds check.\\n\\nA VF attached to a PF that has been put into switchdev\\nrepresentor mode reaches this path: the VF mailbox handler\\notx2_pfvf_mbox_handler() forwards every message id including\\nMBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF\\ndispatcher rewrites only msg-\u003epcifunc, leaving struct\\nrep_event::pcifunc attacker-controlled.  The sibling\\nrvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc\\nis not rvu-\u003erep_pcifunc; this handler has no equivalent gate.\\n\\nAn out-of-range body pcifunc selects an \u0026rvu-\u003epf[]/\u0026rvu-\u003ehwvf[]\\nelement past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE,\\nturns into a six-byte attacker-chosen OOB ether_addr_copy() target\\ninside the queued worker; KASAN reports a slab-out-of-bounds write\\nin rvu_rep_wq_handler.\\n\\nReject malformed requests at the handler entry by gating on\\nis_pf_func_valid(), which is already the canonical PF/VF range check\\nin this driver; expose it via rvu.h so callers in rvu_rep.c can use\\nit instead of open-coding the same range arithmetic.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/rvu.c\",\"drivers/net/ethernet/marvell/octeontx2/af/rvu.h\",\"drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b8fea84a0468404fe3b3327ad54d583950be9dec\",\"lessThan\":\"4467fa514482bbce82f73788943c815f3d126ab3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8fea84a0468404fe3b3327ad54d583950be9dec\",\"lessThan\":\"68be0260e2a02ff9b18a8678d5f8d1715fa20138\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8fea84a0468404fe3b3327ad54d583950be9dec\",\"lessThan\":\"2156a29aecfffa2eb7c558255690084efbe9f3b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/rvu.c\",\"drivers/net/ethernet/marvell/octeontx2/af/rvu.h\",\"drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4467fa514482bbce82f73788943c815f3d126ab3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T11:25:06+00:00",
      "cve": "CVE-2026-63923",
      "id": "CVE-2026-63923",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63923.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T16:49:04Z",
      "cve": "CVE-2026-63923",
      "id": "CVE-2026-63923",
      "initial_release_date": "2026-07-21T13:03:29Z",
      "product_status:first_fixed": "67",
      "product_status:known_affected": "304",
      "product_status:known_not_affected": "39",
      "product_status:recommended": "163",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63923",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63923.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.