CVE-2026-63923

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rvu mbox handler rep event notify() function within the octeontx2-af driver. The function queues a sender-controlled REP EVENT NOTIFY request body without validation. Subsequently, rvu rep up notify() forwards the pcifunc field from the nested body into rvu get pfvf(), rvu get pf(), and the AF-PF mailbox device index without performing bounds checks. When a Virtual Function (VF) is attached to a Physical Function (PF) in switchdev representor mode, the otx2 pfvf mbox handler() forwards messages to the AF dispatcher without an allowlist. This allows an attacker to control the rep event::pcifunc variable. An out-of-range pcifunc value can lead to an out-of-bounds access of the rvu->pf[] or rvu->hwvf[] arrays. Specifically, for RVU EVENT MAC ADDR CHANGE events, this results in a six-byte out-of-bounds write via ether addr copy() within the queued worker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.