CVE-2026-74693 Overview
CVE-2026-74693 is a Linux kernel vulnerability in the Marvell Prestera Ethernet switch driver. The flaw resides in prestera_fw_hdr_parse(), which reads the firmware header before verifying that the firmware image contains enough data for that header. A truncated or malformed firmware image causes the driver to decode magic and version fields from memory beyond the buffer boundary. The upstream fix rejects images shorter than struct prestera_fw_header before parsing proceeds.
Critical Impact
Loading a malformed firmware image into the prestera driver triggers an out-of-bounds read in kernel space, which can lead to information disclosure or kernel instability on affected systems.
Affected Products
- Linux kernel builds containing the net/prestera driver prior to the upstream fix
- Systems using Marvell Prestera-family Ethernet switch ASICs that load vendor firmware through this driver
- Distribution kernels tracking stable branches referenced in the upstream commits
Discovery Timeline
- 2026-08-22 - CVE-2026-74693 published to the National Vulnerability Database (NVD)
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74693
Vulnerability Analysis
The defect exists in the Marvell Prestera Ethernet switch driver's firmware loading path. The function prestera_fw_hdr_parse() dereferences a struct prestera_fw_header overlay against the firmware image buffer before validating that the buffer length is greater than or equal to sizeof(struct prestera_fw_header). When the firmware blob supplied to the driver is shorter than the header structure, the parser still reads the magic and version fields, producing an out-of-bounds read [CWE-125] in kernel memory. The upstream patch series adds an explicit length check that rejects short images before any header field is decoded.
Root Cause
The root cause is missing input validation on an untrusted length. The driver assumes the firmware image is well-formed and at least header-sized. No boundary check protects the initial read. The fix inserts a size comparison against sizeof(struct prestera_fw_header) before the parser touches any header field, and it returns an error for undersized images.
Attack Vector
Exploitation requires the ability to supply a crafted firmware blob to the prestera driver. On typical Linux systems, firmware loading is gated by root privileges and by the kernel firmware search paths under /lib/firmware. A local privileged user, a compromised initramfs, or a supply-chain tampering event that replaces the vendor firmware file can trigger the out-of-bounds read at driver initialization. The vulnerability does not present a remote network attack surface because it operates on locally loaded firmware, not on packets in flight.
Because no verified public exploit code exists for CVE-2026-74693, refer to the upstream patches for the precise before-and-after semantics: Kernel Commit 0fbcceb9d19f and Kernel Commit 363e048a9d0a.
Detection Methods for CVE-2026-74693
Indicators of Compromise
- Kernel log entries from the prestera driver reporting firmware parsing errors, unexpected magic values, or unsupported version fields during module load.
- Unexplained modifications to firmware files under /lib/firmware/mrvl/prestera/ on hosts running Marvell switch ASICs.
- Kernel oops or KASAN slab-out-of-bounds reports referencing prestera_fw_hdr_parse in the call stack.
Detection Strategies
- Inventory running kernels and compare against the fixed commits listed on the upstream stable branches to identify vulnerable hosts.
- Enable KASAN on test kernels used for driver validation to surface out-of-bounds reads triggered by malformed firmware payloads.
- Monitor dmesg output on systems that load the prestera module and alert on parse failures or module load errors.
Monitoring Recommendations
- Forward kernel logs to a central log platform and build alerts for messages emitted by the prestera driver during firmware load.
- Track file integrity on /lib/firmware paths that hold prestera images to identify tampering that could deliver crafted blobs.
- Correlate driver load events with privileged user activity to identify unexpected reload sequences that could indicate exploitation attempts.
How to Mitigate CVE-2026-74693
Immediate Actions Required
- Apply the upstream kernel fix or the vendor-backported patch to all systems running the prestera driver.
- Restrict write access to /lib/firmware and the initramfs generation pipeline so only trusted administrators can stage firmware.
- Verify firmware blobs against vendor-published hashes before deployment to switch hosts.
Patch Information
The fix is available in the following upstream commits: 0fbcceb9d19f, 363e048a9d0a, 38a3afbf9fd8, 470ac9cce730, 6fad06bb793d, 7fa8a12296d8, 8ae344eb540a, and e0f382e80841. Track your distribution's security channel for the corresponding backport.
Workarounds
- Unload or blacklist the prestera module on hosts that do not require Marvell switch ASIC support until the patched kernel is deployed.
- Enforce signed firmware policies and secure boot to prevent unauthorized firmware substitution on affected switch platforms.
- Limit local administrative access so only trusted operators can trigger firmware reloads during the patch window.
# Configuration example: blacklist prestera until patched kernel is deployed
echo 'blacklist prestera' | sudo tee /etc/modprobe.d/prestera-blacklist.conf
sudo rmmod prestera 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
