Bug 2536617 (CVE-2026-90085) - CVE-2026-90085 kernel: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path
Summary: CVE-2026-90085 kernel: octeontx2-af: fix NULL deref in NIX TM tree debugfs re...
Keywords:
Status: NEW
Alias: CVE-2026-90085
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 18:53 UTC by OSIDB Bzimport
Modified: 2026-10-13 12:30 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 18:53:07 UTC
In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without
checking whether the SQ context has been allocated. Reading
/sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF whose transmit
queues are not set up triggers a kernel oops.

Guard the read path the same way rvu_dbg_nix_tm_tree_write() already
does and return -EINVAL with a seq_file message when sq_ctx is NULL.


Note You need to log in before you can comment on or make changes to this bug.