CVE-2026-64224 Overview
CVE-2026-64224 is a double free vulnerability in the Linux kernel octeontx2-pf driver, specifically in the rvu_rep_rsrc_init() function used by the Marvell OcteonTX2 representor. The function allocates queue memory before calling otx2_init_hw_resources(). When hardware resource setup fails, the initialization routine already unwinds partially initialized send queue (SQ), completion queue (CQ), and aura state before returning an error. The representor error path then calls otx2_free_hw_resources() a second time, releasing the same resources twice.
Critical Impact
A double free of kernel resources in the OcteonTX2 representor error path can lead to kernel memory corruption and potential denial of service on affected systems.
Affected Products
- Linux kernel octeontx2-pf driver (Marvell OcteonTX2 representor)
- Linux kernel versions confirmed present in v6.13-rc1 through v7.1-rc3
- Systems using OcteonTX2 representor hardware
Discovery Timeline
- 2026-07-24 - CVE-2026-64224 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64224
Vulnerability Analysis
The vulnerability resides in rvu_rep_rsrc_init() within the octeontx2-pf network driver. The function first allocates queue memory, then invokes otx2_init_hw_resources() to initialize hardware resources. If hardware resource setup fails, otx2_init_hw_resources() performs its own cleanup, unwinding partially initialized SQ, CQ, and aura state before returning an error code.
The caller does not distinguish between failures that occurred before or after hardware resource initialization completed. As a result, the representor error path unconditionally calls otx2_free_hw_resources(), freeing resources that the initialization routine has already released. This produces a classic double free condition on kernel data structures.
The fix splits the cleanup labels so a failure returned from otx2_init_hw_resources() only releases queue memory. The call to otx2_free_hw_resources() is retained only for failures that occur after hardware resource initialization has completed successfully.
Root Cause
The root cause is overlapping cleanup responsibilities between caller and callee. otx2_init_hw_resources() cleans up partial state on failure, but the caller repeats that cleanup, violating the invariant that each resource must be freed exactly once [CWE-415].
Attack Vector
Triggering the vulnerable path requires OcteonTX2 representor hardware and a failure during hardware resource initialization. Runtime validation was not performed by the reporter because reproducing the path requires the specific hardware. The bug is not known to be remotely exploitable and requires local conditions that produce a hardware resource setup failure during driver initialization.
The vulnerability was flagged by an experimental static analysis tool developed for kernel memory-management bugs while analyzing v6.13-rc1. Manual inspection confirmed the bug remained present in v7.1-rc3. See the upstream commits for the exact code changes: 8864b664d044, e8fb3de2a8ef, and eb72a65f2bb2.
Detection Methods for CVE-2026-64224
Indicators of Compromise
- Kernel oops or panic messages referencing rvu_rep_rsrc_init, otx2_free_hw_resources, or slab allocator double free warnings.
- kernel: BUG: KASAN: double-free entries in dmesg on systems using OcteonTX2 representor hardware.
- Unexpected reboots or driver initialization failures on hosts equipped with Marvell OcteonTX2 network adapters.
Detection Strategies
- Audit kernel versions on affected hardware and compare against the fix commits listed in the NVD references.
- Enable KASAN (Kernel Address Sanitizer) in test environments to surface double free conditions during driver initialization.
- Review boot logs for octeontx2-pf initialization errors that precede kernel memory allocator warnings.
Monitoring Recommendations
- Forward kernel logs from OcteonTX2-equipped hosts to a central logging pipeline and alert on double free or slab corruption signatures.
- Track kernel version inventory across fleet nodes to identify unpatched systems that use the octeontx2-pf driver.
- Monitor for unexpected network interface flaps or driver reinitialization events on hosts with representor hardware.
How to Mitigate CVE-2026-64224
Immediate Actions Required
- Identify all hosts running Linux kernels between v6.13-rc1 and v7.1-rc3 that load the octeontx2-pf driver.
- Apply the upstream stable kernel commits that split the cleanup labels in rvu_rep_rsrc_init().
- Rebuild and redeploy custom kernels that include the octeontx2-pf driver from affected versions.
Patch Information
The fix is available in the mainline and stable Linux trees via commits 8864b664d044, e8fb3de2a8ef, and eb72a65f2bb2. The patch splits cleanup labels so otx2_free_hw_resources() is only invoked when hardware resource initialization completed successfully.
Workarounds
- If no representor functionality is required, avoid loading the octeontx2-pf driver on affected kernels by blacklisting the module.
- Restrict physical and administrative access to hosts with OcteonTX2 representor hardware until the patched kernel is deployed.
- Track distribution vendor advisories for backported fixes if running an enterprise Linux kernel that has not yet incorporated the upstream commits.
# Blacklist the octeontx2-pf module on affected systems until patched
echo "blacklist octeontx2_pf" | sudo tee /etc/modprobe.d/blacklist-octeontx2.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
