CVE-2026-63923: Linux Kernel Privilege Escalation Flaw

CVE-2026-63923 Overview

CVE-2026-63923 is a Linux kernel vulnerability in the Marvell OcteonTX2 Admin Function (AF) driver. The flaw resides in rvu_mbox_handler_rep_event_notify() within drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c. The handler queues an attacker-controlled REP_EVENT_NOTIFY request body without validating the nested event->pcifunc field. A malicious virtual function (VF) attached to a physical function (PF) in switchdev representor mode can supply an out-of-range pcifunc value. The kernel then indexes past the allocated rvu->pf[] or rvu->hwvf[] arrays, producing a slab-out-of-bounds write during ether_addr_copy() in the queued worker.

Critical Impact
A local attacker with control of a VF can trigger a six-byte out-of-bounds write in kernel memory, leading to privilege escalation or kernel compromise.

Affected Products

Linux kernel builds containing the Marvell octeontx2-af driver prior to the fix
Systems using OcteonTX2 network adapters with switchdev representor mode enabled
PF/VF configurations exposing MBOX_MSG_REP_EVENT_NOTIFY to guest VFs

Discovery Timeline

2026-07-19 - CVE-2026-63923 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63923

Vulnerability Analysis

The OcteonTX2 AF driver implements a mailbox protocol between the AF, PFs, and their VFs. When a VF sends a message, the VF mailbox handler otx2_pfvf_mbox_handler() forwards every message identifier to the AF without an allowlist, including MBOX_MSG_REP_EVENT_NOTIFY. The AF dispatcher rewrites only the header pcifunc field to reflect the sender, leaving the nested struct rep_event::pcifunc under attacker control.

Inside rvu_mbox_handler_rep_event_notify(), the request body is queued verbatim to a worker. The worker function rvu_rep_up_notify() then passes the untrusted nested pcifunc value into rvu_get_pfvf(), rvu_get_pf(), and the AF-to-PF mailbox device index. None of these callers perform bounds checking on the attacker-supplied identifier.

Root Cause

The root cause is missing input validation [Improper Input Validation] on the nested pcifunc field carried inside the REP_EVENT_NOTIFY body. The sibling handler rvu_mbox_handler_esw_cfg() rejects requests whose header pcifunc does not match rvu->rep_pcifunc, but the vulnerable handler has no equivalent gate. This inconsistency lets malformed requests reach array-indexing logic that assumes trusted input.

Attack Vector

Exploitation requires local access to a VF attached to a PF placed in switchdev representor mode. The attacker crafts a REP_EVENT_NOTIFY mailbox message with an out-of-range event->pcifunc value. Once queued, the worker calls ether_addr_copy() against the resulting pointer, producing a six-byte attacker-chosen write past the allocated rvu->pf[] or rvu->hwvf[] array. KASAN reports the corruption as a slab-out-of-bounds write in rvu_rep_wq_handler. The fix rejects malformed requests at the handler entry by gating on is_pf_func_valid(), the canonical PF/VF range check already used elsewhere in the driver.

See the upstream patches for technical details: Kernel commit 2156a29a and Kernel commit 68be0260.

Detection Methods for CVE-2026-63923

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds writes inside rvu_rep_wq_handler or rvu_rep_up_notify.
Unexpected kernel oops or panic entries traced back to the octeontx2-af driver.
Anomalous REP_EVENT_NOTIFY mailbox activity originating from guest VFs.

Detection Strategies

Enable KASAN on test kernels running the octeontx2-af driver to surface out-of-bounds writes at exploit time.
Audit kernel logs for octeontx2-af warnings or MAC address change events tied to unexpected PF/VF identifiers.
Correlate VF creation and switchdev mode transitions with subsequent mailbox anomalies through EDR telemetry.

Monitoring Recommendations

Track kernel version and patch level across fleets that deploy Marvell OcteonTX2 hardware.
Alert on new VF attachments to PFs configured in switchdev representor mode.
Ship dmesg and KASAN traces to a centralized log platform for retrospective analysis.

How to Mitigate CVE-2026-63923

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all affected hosts.
Inventory systems using Marvell OcteonTX2 network hardware and confirm patched kernel deployment.
Restrict which tenants and workloads receive VFs on PFs operating in switchdev representor mode.

Patch Information

The upstream fix adds a call to is_pf_func_valid() at the entry of rvu_mbox_handler_rep_event_notify() and exposes that helper through rvu.h so callers in rvu_rep.c share the canonical PF/VF range check. Deploy the patched kernel from commit 2156a29a or the backport in commit 68be0260.

Workarounds

Disable switchdev representor mode on PFs where guest VFs are untrusted until patched kernels are deployed.
Avoid exposing VFs from vulnerable PFs to untrusted virtual machines or container tenants.
Reduce local attack surface by limiting CAP_NET_ADMIN and mailbox access on shared systems.

bash

# Verify running kernel version and octeontx2-af module status
uname -r
modinfo octeontx2_af | grep -E '^(version|srcversion|filename):'

# Temporarily unload the driver on hosts that do not require it
sudo rmmod octeontx2_af