CVE-2026-80629 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: npc: Fix size of entry2cntr_map
KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries.
BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14
CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events work_for_cpu_fn Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x88/0xb4 print_report+0x154/0x458 kasan_report+0xb8/0x194 __asan_store2+0x7c/0xa0 npc_map_mcam_entry_and_cntr+0xb0/0x1a0 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280 npc_install_flow+0x840/0xfe0 rvu_npc_install_cpt_pass2_entry+0x138/0x190 rvu_nix_init+0x148c/0x2880 rvu_probe+0x1800/0x30b0 local_pci_probe+0x78/0xe0 work_for_cpu_fn+0x30/0x50 process_one_work+0x4cc/0x97c worker_thread+0x360/0x630 kthread+0x1a0/0x1b0 ret_from_fork+0x10/0x20
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel vulnerability identified in the octeontx2-af network driver involves a critical memory management error within the MACsec and flow classification subsystem. Specifically, the flaw resides in the npc_map_mcam_entry_and_cntr function where the system attempts to allocate a counter for a reserved Multi-Action CAM (MCAM) entry designated for CPT second pass processing. The root cause is that while the driver logic proceeds with allocating resources for this specific type of entry, it fails to ensure that the corresponding mcam->entry2cntr_map array has been properly allocated or initialized to accommodate entries marked as reserved. This oversight leads to a scenario where the kernel attempts to write counter mapping data into an unallocated memory region within the slab allocator.
This technical flaw manifests as a Kernel Address Sanitizer (KASAN) report indicating a slab-out-of-bounds error. The specific operation involves writing two bytes of data at a calculated address that falls outside the bounds of the allocated object. This occurs during the initialization phase when rvu_nix_init calls rvu_npc_install_cpt_pass2_entry, which in turn invokes npc_map_mcam_entry_and_cntr. Because the entry2cntr_map array does not include space for reserved entries, any attempt to map a counter to such an entry results in writing beyond the end of the valid memory block. This is classified under CWE-787 as an out-of-bounds write vulnerability, which poses significant risks including potential kernel panic, data corruption, or exploitation by local attackers to gain elevated privileges if they can trigger this code path through crafted network configurations or driver interactions.
The operational impact of this vulnerability extends beyond immediate system instability. In a production environment, triggering this bug via the workqueue mechanism associated with PCI probe operations could lead to an instantaneous kernel crash, resulting in service denial for any applications relying on the Marvell CN106XX hardware acceleration features. Furthermore, out-of-bounds writes are frequently leveraged in exploit chains to overwrite adjacent memory structures, potentially allowing arbitrary code execution or privilege escalation from user space to ring zero. The vulnerability is particularly dangerous because it occurs during driver initialization and flow installation processes, which may be triggered by standard network configuration changes if the hardware supports dynamic reconfiguration of MCAM entries without proper bounds checking.
To mitigate this risk, immediate patching of the Linux kernel version containing the fix for octeontx2-af npc is required. The resolution involves modifying the driver logic to correctly allocate and manage memory for reserved MCAM entries within the entry2cntr_map structure before attempting any counter mappings. Administrators should ensure that their systems are updated with the latest stable kernel releases that include this specific commit. Additionally, enabling KASAN in development environments can help detect similar out-of-bounds access issues early in the software lifecycle. From a defense-in-depth perspective, restricting unprivileged user access to network driver configuration interfaces and monitoring for unusual workqueue activity related to NPC MCAM operations can provide supplementary protection against exploitation attempts targeting this class of memory safety vulnerabilities aligned with ATT&CK techniques involving local privilege escalation through kernel exploits.