---
id: CVE-2026-80629
title: 'octeontx2-af: npc: Fix size of entry2cntr_map'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-af: npc: Fix size of entry2cntr_map

  KASAN prints below splat. This is caused by allocating counter for
  reserved mcam entry for cpt 2nd pass entry. But mcam->…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd <
    30e5ee98e86ad47c76695458987097e849d0611a
  - >-
    Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd <
    de8e3a4004c5df9461974352e9d7ff0f8313c508
  - >-
    Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd <
    1d072cc3ba4338d6b2acb85d50a3af5cf2b12a3e
  - >-
    Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd <
    2477c523c6e69733d51101ae9bd2dfc0a054b13d
  - >-
    Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd <
    f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232
  - Linux 5.11
published: '2026-08-28'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:46:39.362Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80629'
references:
  - url: 'https://git.kernel.org/stable/c/30e5ee98e86ad47c76695458987097e849d0611a'
  - url: 'https://git.kernel.org/stable/c/de8e3a4004c5df9461974352e9d7ff0f8313c508'
  - url: 'https://git.kernel.org/stable/c/1d072cc3ba4338d6b2acb85d50a3af5cf2b12a3e'
  - url: 'https://git.kernel.org/stable/c/2477c523c6e69733d51101ae9bd2dfc0a054b13d'
  - url: 'https://git.kernel.org/stable/c/f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10412
ingestedAt: '2026-10-21T12:48:53.755Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: npc: Fix size of entry2cntr_map

KASAN prints below splat. This is caused by allocating counter for
reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map
is not allocated for reserved entries.

BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0
Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14

CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1
Hardware name: Marvell CN106XX board (DT)
Workqueue: events work_for_cpu_fn
Call trace:
 dump_backtrace.part.0+0xe4/0xf0
 show_stack+0x18/0x30
 dump_stack_lvl+0x88/0xb4
 print_report+0x154/0x458
 kasan_report+0xb8/0x194
 __asan_store2+0x7c/0xa0
 npc_map_mcam_entry_and_cntr+0xb0/0x1a0
 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280
 npc_install_flow+0x840/0xfe0
 rvu_npc_install_cpt_pass2_entry+0x138/0x190
 rvu_nix_init+0x148c/0x2880
 rvu_probe+0x1800/0x30b0
 local_pci_probe+0x78/0xe0
 work_for_cpu_fn+0x30/0x50
 process_one_work+0x4cc/0x97c
 worker_thread+0x360/0x630
 kthread+0x1a0/0x1b0
 ret_from_fork+0x10/0x20

## Affected

- `Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd < 30e5ee98e86ad47c76695458987097e849d0611a`
- `Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd < de8e3a4004c5df9461974352e9d7ff0f8313c508`
- `Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd < 1d072cc3ba4338d6b2acb85d50a3af5cf2b12a3e`
- `Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd < 2477c523c6e69733d51101ae9bd2dfc0a054b13d`
- `Linux >= 55307fcb925846d760ed80f4a8359dd4331c52bd < f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.