---
id: CVE-2026-63923
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

  rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/
  octeontx2/af/rvu_rep.c qu…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

  rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/
  octeontx2/af/rvu_rep.c qu…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
published: '2026-07-19'
updated: '2026-08-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63923'
references:
  - url: 'https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4467fa514482bbce82f73788943c815f3d126ab3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63923.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-63923'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502418'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63923'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63923'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63923-8d3f@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:67470'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68507'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00166
epssPercentile: 0.06286
ingestedAt: '2026-08-03T10:24:20.562Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 9)
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
patched:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
cwe:
  - CWE-787
scores:
  nvd: 8.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/
octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY
request body verbatim, and rvu_rep_up_notify() then forwards
event->pcifunc (the nested body field, distinct from the
AF-normalised header pcifunc) into rvu_get_pfvf(), rvu_get_pf() and
the AF->PF mailbox device index without any bounds check.

A VF attached to a PF that has been put into switchdev
representor mode reaches this path: the VF mailbox handler
otx2_pfvf_mbox_handler() forwards every message id including
MBOX_MSG_REP_EVENT_NOTIFY to AF without an allowlist, and the AF
dispatcher rewrites only msg->pcifunc, leaving struct
rep_event::pcifunc attacker-controlled.  The sibling
rvu_mbox_handler_esw_cfg() refuses requests whose header pcifunc
is not rvu->rep_pcifunc; this handler has no equivalent gate.

An out-of-range body pcifunc selects an &rvu->pf[]/&rvu->hwvf[]
element past the allocated array and, for RVU_EVENT_MAC_ADDR_CHANGE,
turns into a six-byte attacker-chosen OOB ether_addr_copy() target
inside the queued worker; KASAN reports a slab-out-of-bounds write
in rvu_rep_wq_handler.

Reject malformed requests at the handler entry by gating on
is_pf_func_valid(), which is already the canonical PF/VF range check
in this driver; expose it via rvu.h so callers in rvu_rep.c can use
it instead of open-coding the same range arithmetic.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67470** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67470)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63923.json)
- **RHSA-2026:68507** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68507)