CVE-2026-90079

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()

rvu_mbox_init() is called separately for AF-PF mailboxes during probe

and for AF-VF mailboxes when SR-IOV is enabled. Each call used to

allocate a new ng_rvu object, leaking the first allocation when the

pointer was overwritten on the second call.

Sharing one ng_rvu across both paths exposed several teardown bugs:

the error path freed all cn20k mailbox DMA and kfree()d ng_rvu even

when only the failing init type should be unwound, leaving live AF-PF

mailbox memory in use after an AF-VF init failure. mutex_init() was

also re-run on the AF-VF path while AF-PF mailbox handlers could still

hold rvu->mbox_lock. Probe and SR-IOV failure paths did not release

cn20k mailbox DMA either, since cleanup only happened in rvu_remove().

Allocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the

same block, unwind only the mailbox memory for the fai

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References