CVE-2026-64225: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64225 Overview

CVE-2026-64225 is an out-of-bounds read vulnerability in the Linux kernel's octeontx2-af driver, specifically in the Common Gigabit Ethernet (CGX) subsystem. The cgx_speed_mbps array contains 13 elements, but the RESP_LINKSTAT_SPEED field can return values in the range 0-15. When the returned speed index exceeds 12, the driver performs an out-of-bounds array access. Kernel maintainers have resolved the issue by adding a bounds check that defaults the speed to 0 when the index is out of range.

Critical Impact
Out-of-bounds read in the CGX link status handler can yield unpredictable speed values or trigger kernel memory disclosure on affected Marvell OcteonTX2 platforms.

Affected Products

Linux kernel octeontx2-af driver (Marvell OcteonTX2 Admin Function)
CGX (Common Gigabit Ethernet) subsystem consuming RESP_LINKSTAT_SPEED
Multiple stable Linux kernel branches receiving backports across eight upstream commits

Discovery Timeline

2026-07-24 - CVE-2026-64225 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64225

Vulnerability Analysis

The vulnerability resides in the Marvell OcteonTX2 Admin Function (octeontx2-af) driver that manages the CGX Ethernet controller. The driver maintains a lookup table named cgx_speed_mbps used to translate a hardware-reported speed identifier into a numeric megabits-per-second value. This table has 13 entries indexed 0 through 12.

The firmware response field RESP_LINKSTAT_SPEED occupies four bits and therefore encodes any value from 0 to 15. When the firmware or link state returns an index between 13 and 15, the driver dereferences memory beyond the bounds of cgx_speed_mbps. This constitutes an out-of-bounds read [CWE-125] and produces attacker-influenced or undefined speed values that flow into higher-layer link state reporting.

Root Cause

The root cause is missing input validation on a firmware-supplied index. The driver trusted the width of the response field to fall within the size of the lookup table, but the field's value range exceeds the array length. No bounds check preceded the array dereference.

Attack Vector

Exploitation requires the firmware or link partner state to produce a RESP_LINKSTAT_SPEED value of 13, 14, or 15. On affected hardware, this results in the kernel reading adjacent memory when translating the link speed. The consequence is inaccurate link reporting at minimum, and potential leakage of adjacent kernel data into speed-reporting interfaces on affected devices. The issue is constrained to systems using the Marvell OcteonTX2 CGX driver.

Because no verified proof-of-concept exists, refer to the upstream fix commits for exact code paths and remediation logic. See the Kernel Git Change Log for the patch that adds the bounds check and defaults to speed 0 when the index is out of range.

Detection Methods for CVE-2026-64225

Indicators of Compromise

Anomalous or nonsensical link speed values reported by octeontx2-af-managed interfaces on OcteonTX2 hardware.
Kernel warnings, KASAN reports, or oops entries referencing cgx_speed_mbps or the CGX link status handler.
Unexpected values surfaced by ethtool for CGX-backed interfaces.

Detection Strategies

Enumerate kernel versions across the Linux fleet and cross-reference against the fixed commits listed in the upstream references.
On systems with KASAN or UBSAN enabled, monitor for out-of-bounds read reports referencing the octeontx2-af module.
Inventory hosts running the octeontx2-af module (lsmod | grep octeontx2_af) to scope exposure to Marvell OcteonTX2 platforms.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on octeontx2-af or CGX warnings.
Track kernel package versions across managed Linux endpoints and flag hosts running pre-patch stable kernels.
Baseline expected link speeds on CGX-backed interfaces and alert on reported values outside the known-valid set.

How to Mitigate CVE-2026-64225

Immediate Actions Required

Apply the upstream kernel patches from the referenced git.kernel.org commits to all affected stable branches.
Update to a distribution kernel that incorporates the cgx_speed_mbps bounds check.
Prioritize patching on hosts using Marvell OcteonTX2 hardware where the octeontx2-af driver is loaded.

Patch Information

The fix adds a bounds check on the speed index and defaults to speed 0 when the index is out of range. The upstream commits are available at the primary fix commit and seven additional stable backports referenced in NVD, including commits 2c3d26b4, 47a4cf22, 8201bf45, 93d3dc81, 985b5e38, c0bf0a4f, and e043017a.

Workarounds

If patching is not immediately possible and the hardware is not required, unload the octeontx2_af module on affected hosts.
Restrict administrative access to firmware update paths that could influence CGX link state reporting.
Enable KASAN in test environments to surface any residual out-of-bounds accesses during validation of the applied patch.

bash

# Verify whether the octeontx2-af driver is loaded and inspect kernel version
uname -r
lsmod | grep octeontx2_af
# If patching is deferred and the module is not required:
sudo modprobe -r octeontx2_af