CVE-2023-54129

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.4.210-g2e3169d8e1bc-dirty #17

Description The Linux kernel contains a flaw in the octeontx2-af driver related to the validation of the lmac type id field received from firmware during physical link changes. Specifically, when firmware provides an invalid lmac type id, it can lead to a kernel panic. The issue arises because the kernel derives the lmac type based on this ID without proper validation. The fix involves adding validation for the lmac type id field to prevent the kernel panic. The vulnerable code involves the strncpy function and the cgx link change handler function.

Recommendations Update the Linux kernel to version 5.4.210-g2e3169d8e1bc-dirty #17 or a later version to address this issue.