---
id: CVE-2026-90080
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

  af_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is
  allocated during PF/VF probe
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

  af_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is
  allocated during PF/VF probe. Represento…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= efabce29015189cb5cd8066cf29eb1d754de6c3c <
    b003d5b4e46ca5033859db601e12d36da24d0e40
  - >-
    Linux >= efabce29015189cb5cd8066cf29eb1d754de6c3c <
    7e33c6bd049b532d2ec4916895ef07e538bed905
  - >-
    Linux >= efabce29015189cb5cd8066cf29eb1d754de6c3c <
    b09a0503c755b6609fad59a84cc7f05b6843a03c
  - Linux 9bd7273cf1f9c5761d696cca821d25602e8f7009
  - Linux >= 6.14.9 < 6.15
  - Linux 6.15
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:57.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90080'
references:
  - url: 'https://git.kernel.org/stable/c/7e33c6bd049b532d2ec4916895ef07e538bed905'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b003d5b4e46ca5033859db601e12d36da24d0e40'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b09a0503c755b6609fad59a84cc7f05b6843a03c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.895Z'
epss: 0.00206
epssPercentile: 0.09433
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup

af_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is
allocated during PF/VF probe. Representors and other non-AF_XDP paths
leave the pointer NULL, but several call sites used test_bit() on it
unconditionally.

Switching to devlink eswitch mode creates representors and runs
otx2_init_hw_resources(), which reaches otx2_pool_aq_init() and oopses
when dereferencing the NULL bitmap. Add NULL checks before every
af_xdp_zc_qidx test_bit() use in the RSS, ethtool, XSK, and pool init
paths.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.