CVE-2026-90079

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the octeontx2-af driver where the rvu mbox init() function allocates a new ng rvu object on each call. When called separately for AF-PF mailboxes during probe and AF-VF mailboxes during SR-IOV enablement, the first allocation is leaked. Additionally, sharing a single ng rvu across these paths leads to teardown bugs, such as the error path freeing all cn20k mailbox DMA and the ng rvu object even when only one initialization type failed. This can leave live AF-PF mailbox memory in use. Furthermore, mutex init() may be re-executed on the AF-VF path while AF-PF mailbox handlers still hold the rvu->mbox lock. Finally, probe and SR-IOV failure paths fail to release cn20k mailbox DMA because cleanup was previously only performed in rvu remove().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.