CVE-2026-93246 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
rvu_register_interrupts() walks every MSI-X vector and uses strstr() to match "Mbox" or "FLR" in irq_name before pinning those interrupts to CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every slot is populated before this loop runs. strstr() keeps scanning until it finds a NUL terminator, so an uninitialized slot can trigger a KASAN slab-out-of-bounds read at boot when debug options are enabled.
Use strnstr() with NAME_SIZE to bound the search within each vector's name buffer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified in the octeontx2-af driver involves an out-of-bounds memory read that occurs during the initialization of Message Signaled Interrupts (MSI-X). The root cause lies within the rvu_register_interrupts function, which is responsible for configuring interrupt affinity by iterating through every available MSI-X vector. For specific vectors associated with mailbox communications or Function Level Reset operations, identified by strings containing "Mbox" or "FLR" in their irq_name field, the driver attempts to pin these interrupts to CPU 0 to ensure predictable performance and isolation. This identification process relies on the strstr function to search for these substrings within a per-vector buffer named NAME_SIZE.
The technical flaw stems from an assumption that all slots in the MSI-X vector array are fully populated with valid strings before this loop executes. In reality, not every slot is guaranteed to be initialized prior to this operation. When strstr encounters an uninitialized or partially filled buffer, it continues scanning memory beyond the allocated boundaries of the NAME_SIZE buffer until it locates a NUL terminator elsewhere in memory. This behavior results in a slab-out-of-bounds read, which can trigger kernel warnings via KASAN (Kernel Address Sanitizer) when debug options are enabled during boot. While this may not always lead to immediate exploitation or system crashes under normal conditions, it represents a significant stability risk and potential information disclosure vector if the out-of-bounds access reveals sensitive memory contents.
From a security classification perspective, this vulnerability aligns with CWE-125, which describes an Out-of-Bounds Read condition where software reads data past the end or before the beginning of the intended buffer. In terms of attack vectors and detection techniques, this flaw relates to ATT&CK technique T1083, File and Directory Discovery, as improper memory access can inadvertently expose system configuration details. Furthermore, it touches upon CWE-20, Improper Input Validation, because the driver fails to validate that the input buffer is properly terminated within its expected bounds before performing string operations. The lack of boundary checking allows an attacker who might influence the initialization sequence or exploit race conditions during boot to potentially trigger this out-of-bounds access more reliably.
The operational impact of this vulnerability includes potential system instability, kernel panics, or degraded performance due to excessive error handling overhead when KASAN is active. In a production environment without debug flags enabled, the immediate risk might be lower, but the underlying memory safety issue remains present and could lead to undefined behavior under specific hardware states or timing conditions. Mitigation requires updating the octeontx2-af driver code to replace strstr with strnstr. By using strnstr with a limit of NAME_SIZE, the search operation is strictly bounded within each vector's name buffer, preventing any access beyond the allocated memory region. System administrators should apply kernel updates that include this patch as soon as they are available from their distribution vendors to ensure memory safety and maintain system integrity during boot processes involving MSI-X interrupt configuration.