CVE-2026-63923

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/

octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY

request body verbatim, and rvu_rep_up_notify() then forwards

event->pcifunc (the nested body field, distinct from the

AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and

the AF->PF mailbox device index without any bounds check.

A VF attached to a PF that has been put into switchdev

representor mode reaches this path: the VF mailbox handler

otx2_pfvf_mbox_handler() forwards every message id including

MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF

dispatcher rewrites only msg->pcifunc, leaving struct

rep_event::pcifunc attacker-controlled. The sibling

rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc

is not rvu->rep_pcifunc; this handler has no equivalent gate.

A

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References