CVE-2026-46249: Linux Kernel OcteonTX2 DoS Vulnerability

CVE-2026-46249 Overview

CVE-2026-46249 affects the Linux kernel's octeontx2-af network driver. The flaw causes a Physical Function (PF) driver crash during a kexec kernel reboot when the Admin Function (AF) and PF drivers are built as kernel modules. Because kexec does not power-cycle hardware, Resource Virtualization Unit Module (RVUM) state from the previous kernel persists. The PF driver inspects the RVUM block revision to determine whether AF initialization has completed. When the value is left uncleared at shutdown, the PF driver probes against stale hardware state and crashes.

Critical Impact
A driver crash during kexec boot can prevent network functionality on Marvell OcteonTX2 platforms, disrupting availability on affected systems.

Affected Products

Linux kernel octeontx2-af driver (Marvell OcteonTX2 Admin Function)
Systems using the OcteonTX2 PF driver built as a loadable module
Marvell OcteonTX2 networking platforms performing kexec reboots

Discovery Timeline

2026-06-03 - CVE-2026-46249 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-46249

Vulnerability Analysis

The vulnerability resides in the Marvell OcteonTX2 Admin Function (octeontx2-af) driver in the Linux kernel. The driver manages the Resource Virtualization Unit (RVU) hardware block that allocates resources to Physical Functions and Virtual Functions on OcteonTX2 network devices. When the system performs a kexec reboot, the new kernel boots directly without a hardware reset, leaving device registers populated with values from the previous kernel.

The PF driver uses the RVUM block revision register as a synchronization signal. A non-zero value indicates the AF driver has completed initialization and the hardware is ready for PF probing. With AF and PF compiled as modules, module load ordering is not guaranteed. The PF driver can probe before the AF driver reinitializes the device, reads the stale revision left by the prior kernel, and proceeds to access uninitialized hardware state. The result is a kernel oops in the PF probe path.

Root Cause

The root cause is missing state cleanup at AF driver shutdown. The driver did not clear the RVUM block revision register before the kernel powered down or transitioned via kexec. This left a misleading readiness indicator in hardware. The fix clears the RVUM block revision during AF shutdown so the next kernel sees a clean state and the PF driver waits for proper AF reinitialization.

Attack Vector

This is a reliability and availability flaw triggered by a legitimate administrative action — a kexec reboot on affected Marvell OcteonTX2 hardware running modular AF and PF drivers. There is no remote attack vector and no known exploitation path. Triggering the crash requires local administrative privileges sufficient to perform a kexec.

The vulnerability manifests in the AF shutdown and PF probe code paths of drivers/net/ethernet/marvell/octeontx2/af. See the upstream commits referenced below for the exact register-clearing logic added during AF teardown.

Detection Methods for CVE-2026-46249

Indicators of Compromise

Kernel oops or panic in the octeontx2-af or octeontx2-pf probe path immediately after a kexec boot
dmesg entries showing PF probe failure referencing RVU or AF readiness checks
Loss of network interfaces backed by OcteonTX2 hardware following a kexec transition

Detection Strategies

Audit kernel versions on Marvell OcteonTX2 systems and compare against the patched stable commits listed in the kernel.org references
Inspect kernel configuration for CONFIG_OCTEONTX2_AF=m and CONFIG_OCTEONTX2_PF=m, which is the affected build configuration
Review journalctl -k after kexec operations for crashes correlating with octeontx2 module load events

Monitoring Recommendations

Forward kernel logs from OcteonTX2 platforms to a centralized log store and alert on octeontx2 panic signatures
Track kexec usage in change management and validate driver health after each transition
Maintain a kernel SBOM and reconcile against advisories for the octeontx2-af subsystem

How to Mitigate CVE-2026-46249

Immediate Actions Required

Apply the upstream stable kernel patches that clear the RVUM block revision during AF shutdown
Inventory all Marvell OcteonTX2 deployments and prioritize patching systems that rely on kexec for rebooting
Until patched, avoid kexec on affected hosts and use a full hardware reboot instead

Patch Information

The fix has been merged across multiple stable trees. Reference the upstream commits:

Workarounds

Replace kexec-based reboots with full power-cycle reboots on affected hardware until patches are applied
Build the octeontx2-af and octeontx2-pf drivers as builtin (=y) rather than modules to reduce probe-ordering exposure where supported by the distribution
Manually unload octeontx2-pf before kexec and load it only after octeontx2-af reinitializes the hardware on the new kernel