Linux Kernel Vulnerability in Octeon Driver

CVE-2026-93278

What is CVE-2026-93278?

A vulnerability in the Linux kernel's Octeon driver can lead to a use-after-free condition. This situation occurs when the 'cvm_oct_rx_shutdown' function calls 'free_irq' and 'netif_napi_del' without adequately disabling the NAPI instance beforehand. Consequently, while the IRQ is freed, the NAPI poll function may still be active, leading to access of freed memory when 'cvm_oct_remove' attempts to free the platform structure containing the NAPI instances. This flaw exposes systems to potential crashes and requires prompt attention to mitigate risks.

References