CVE-2026-80629: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80629 Overview

CVE-2026-80629 is an out-of-bounds write vulnerability in the Linux kernel's octeontx2-af driver, specifically in the Network Programmable Classifier (NPC) subsystem. The flaw resides in npc_map_mcam_entry_and_cntr() and occurs when a counter is allocated for a reserved MCAM entry used by the CPT second-pass entry. The mcam->entry2cntr_map array is not sized to include reserved entries, causing a 2-byte slab-out-of-bounds write flagged by KASAN. The issue affects systems using Marvell OcteonTX2 network hardware managed by the octeontx2-af admin function driver.

Critical Impact
A slab-out-of-bounds write in kernel memory can corrupt adjacent kernel structures, leading to kernel instability, denial of service, or potential memory corruption on affected Marvell OcteonTX2 platforms.

Affected Products

Linux kernel with the octeontx2-af driver enabled
Marvell OcteonTX2 / CN106XX platforms using NPC MCAM entries
Kernel builds prior to the fix commits 1d072cc3, 2477c523, de8e3a40, and f9cd6fab

Discovery Timeline

2026-08-28 - CVE-2026-80629 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80629

Vulnerability Analysis

The octeontx2-af driver manages the Admin Function (AF) for Marvell OcteonTX2 network processors. The NPC block uses MCAM (Match Content Addressable Memory) entries to classify packets, and each entry can be associated with a counter through the entry2cntr_map array. The map is allocated to cover the pool of user-assignable MCAM entries but does not include entries that the driver reserves internally, such as the CPT second-pass entry installed by rvu_npc_install_cpt_pass2_entry().

When the reserved entry is later processed through rvu_mbox_handler_npc_mcam_write_entry() and npc_install_flow(), the driver calls npc_map_mcam_entry_and_cntr() and writes a 2-byte counter index at an offset that falls beyond the allocated entry2cntr_map buffer. KASAN reports this as a slab-out-of-bounds write, confirming a heap-based out-of-bounds write in kernel memory.

Root Cause

The root cause is a size mismatch between the pool of MCAM entries the driver may operate on and the entry2cntr_map array used to track counter associations. Reserved entries fall outside the array bounds, so any counter allocation performed for a reserved entry writes past the end of the allocation.

Attack Vector

The faulty code path is reached during driver initialization on Marvell OcteonTX2 hardware when the CPT second-pass entry is installed. Triggering the condition requires the affected hardware and kernel driver rather than remote input. Because no verified exploit or proof of concept is available, the practical impact observed is kernel memory corruption detected by KASAN during device probe. See the Kernel Patch Commit 1d072cc3 for the exact code path.

// No verified exploit code is available for this CVE.
// See kernel patch commits referenced below for the fixed code path.

Detection Methods for CVE-2026-80629

Indicators of Compromise

KASAN log entries reporting slab-out-of-bounds in npc_map_mcam_entry_and_cntr during driver load or device probe.
Kernel call traces referencing rvu_npc_install_cpt_pass2_entry, npc_install_flow, and rvu_mbox_handler_npc_mcam_write_entry.
Unexpected kernel warnings or oops messages on systems using the octeontx2-af driver.

Detection Strategies

Run KASAN-enabled kernels in test environments to surface the out-of-bounds write on affected hardware.
Correlate kernel ring buffer output (dmesg) with driver initialization events on Marvell OcteonTX2 systems.
Track installed kernel versions across the fleet and flag hosts running versions predating the fix commits.

Monitoring Recommendations

Forward kernel logs from OcteonTX2-based appliances to a centralized log platform and alert on KASAN, BUG:, or slab-out-of-bounds strings.
Monitor system reliability metrics (kernel panics, watchdog resets) on hosts using the affected driver.
Include kernel version and driver module inventory in configuration management reporting.

How to Mitigate CVE-2026-80629

Immediate Actions Required

Identify systems running the octeontx2-af kernel driver, particularly Marvell OcteonTX2 / CN10xx hardware.
Apply the upstream kernel fix or update to a stable kernel release that includes the referenced commits.
Restrict administrative access to affected hosts until patched to reduce exposure to any secondary abuse paths.

Patch Information

The issue is resolved upstream by sizing entry2cntr_map to include reserved MCAM entries. The fix is present in the following stable kernel commits: Kernel Patch Commit 1d072cc3, Kernel Patch Commit 2477c523, Kernel Patch Commit de8e3a40, and Kernel Patch Commit f9cd6fab. Apply the fix through your Linux distribution's kernel update channel.

Workarounds

No functional workaround preserves the affected driver path; rebuild or update the kernel with the fix.
If patching is delayed, avoid loading the octeontx2-af driver on non-production hosts where the CPT second-pass path is exercised.
Consider disabling CPT-related features that trigger installation of the reserved MCAM entry until an updated kernel is deployed.

bash

# Verify running kernel and octeontx2-af module status
uname -r
lsmod | grep octeontx2_af
# Review kernel log for KASAN reports referencing npc_map_mcam_entry_and_cntr
dmesg | grep -iE 'kasan|npc_map_mcam_entry_and_cntr'