Out-of-Bounds Read Vulnerability in Linux Kernel's OcteonTX2-AF by Cavium

CVE-2026-93246

What is CVE-2026-93246?

A vulnerability exists in the Linux kernel's octeontx2-af component where the rvu_register_interrupts() function may cause an out-of-bounds read. This occurs when the function traverses every MSI-X vector and checks for specific strings in the irq_name, while not all slots are initialized, potentially leading to a slab-out-of-bounds read when debugging options are enabled. To mitigate this issue, using strnstr() with NAME_SIZE is recommended to ensure the search is restricted within valid boundaries.

References