CVE-2026-64225 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: CGX: add bounds check to cgx_speed_mbps index
cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability identified in the Linux kernel's octeontx2-af driver represents a critical out-of-bounds array access flaw that could potentially lead to system instability or arbitrary code execution. This issue specifically affects the CGX (Common Gigabit eXtension) subsystem within the octeontx2 network adapter driver implementation. The vulnerability stems from a fundamental mismatch between the expected data range and the actual array dimensions used to store link speed information.
The technical flaw manifests in the cgx_speed_mbps array which is designed to accommodate exactly 13 elements representing valid link speeds. However, the RESP_LINKSTAT_SPEED parameter returned by the hardware can potentially contain values ranging from 0 to 15, creating a clear discrepancy where values 13 through 15 would attempt to access array indices that do not exist within the allocated memory space. This classic buffer overflow condition occurs when the driver fails to validate input parameters before using them as array indices, directly violating fundamental security principles of input validation and bounds checking.
The operational impact of this vulnerability extends beyond simple memory corruption as it could enable attackers with local privileges to potentially exploit this condition for privilege escalation or system compromise. When an out-of-bounds access occurs in kernel space, the consequences can range from system crashes and denial of service conditions to more severe exploitation vectors that might allow attackers to execute arbitrary code with kernel privileges. The vulnerability particularly affects systems utilizing octeontx2 network adapters where link status information is continuously monitored and processed by the driver.
This flaw aligns with CWE-129, which specifically addresses "Improper Validation of Array Index," and represents a common pattern in kernel driver development where insufficient input validation leads to memory safety issues. From an ATT&CK perspective, this vulnerability could be leveraged as part of a privilege escalation technique under the Tactic of Privilege Escalation, potentially enabling attackers to move from user space to kernel space through direct kernel object manipulation. The fix implemented addresses this by introducing proper bounds checking mechanisms that validate the RESP_LINKSTAT_SPEED values against the actual array dimensions before any array access occurs.
The mitigation strategy involves adding a simple yet effective bounds check that ensures any value exceeding the valid array range of 0-12 defaults to speed 0, which serves as a safe fallback mechanism. This approach follows secure coding practices recommended by the Linux kernel security team and aligns with defensive programming principles that emphasize fail-safe behavior in system components. The solution prevents memory corruption while maintaining system stability through graceful degradation rather than system crashes or exploitable conditions. Additionally, this fix demonstrates the importance of comprehensive input validation in kernel space drivers where a single unchecked value can compromise entire system security models and operational integrity.