CVE-2026-90085 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF whose transmit queues are not set up triggers a kernel oops.
Guard the read path the same way rvu_dbg_nix_tm_tree_write() already does and return -EINVAL with a seq_file message when sq_ctx is NULL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in the octeontx2-af driver involves a null pointer dereference within the NIX Traffic Manager tree debugfs read path, specifically affecting the rvu_dbg_nix_tm_tree_display function. This flaw arises because the function attempts to access the sq_ctx member of the pfvf structure without first verifying whether the SQ context has been properly allocated or initialized. In systems utilizing this hardware acceleration interface for network packet processing, the transmit queues may not always be fully set up depending on the current state of the logical function and its associated resources. When an administrator or automated monitoring tool attempts to read the /sys/kernel/debug/octeontx2/nix/tm_tree file for a NIX Logical Function where these transmit queues are inactive or uninitialized, the kernel encounters a null pointer reference that it cannot resolve safely.
This technical flaw leads directly to a kernel oops, which is an immediate crash of the affected kernel thread and potentially the entire system if not handled by panic-on-oops configurations. The root cause lies in inconsistent error handling between read and write operations within the driver's debug interface. While the rvu_dbg_nix_tm_tree_write function already implements checks to ensure data validity before proceeding, the corresponding read path lacked this defensive programming practice. This asymmetry creates a predictable attack vector for local users who can access debugfs interfaces, allowing them to trigger a denial of service by causing kernel instability through simple file reads rather than complex exploit chains.
From a classification perspective, this vulnerability aligns with CWE-476, which denotes NULL Pointer Dereference, as the code fails to validate pointers before use. It also relates to CWE-20, Improper Input Validation, since the driver does not adequately verify the state of internal data structures relative to user requests via debugfs. In terms of adversary behavior, this flaw supports ATT&CK technique T1595, Active Scanning, as an attacker could probe system stability and kernel versioning through controlled crashes or error messages returned during enumeration attempts. Furthermore, it falls under T1053, Scheduled Task/Job, if the crash is triggered by automated monitoring scripts that regularly poll debugfs entries for performance metrics.
The operational impact of this vulnerability includes service disruption due to kernel panics and potential information leakage through stack traces printed in system logs during oops events. These dumps may reveal memory layouts or internal driver states that could aid further exploitation attempts against other components. Mitigation strategies primarily involve applying the upstream Linux kernel patch that guards the read path similarly to the write path. This involves adding a conditional check for sq_ctx being NULL before dereferencing it and returning -EINVAL with an appropriate seq_file message when the context is unavailable. System administrators should ensure their kernels are updated to versions containing this fix, particularly those running hardware based on Marvell OcteonTX2 processors where NIX traffic management features are utilized. Additionally, restricting access to debugfs interfaces via mount options or filesystem permissions can reduce the attack surface for local privilege escalation attempts that rely on triggering such kernel faults.