Not yet scoredPublished Aug 28, 2026

CVE-2026-80629octeontx2-af: npc: Fix size of entry2cntr_map

Updated under an hour ago (Oct 27, 2026, 6:20 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: npc: Fix size of entry2cntr_map KASAN prints below splat. This is caused by allocating counter for reserved mcam entry for cpt 2nd pass entry. But mcam->entry2cntr_map is not allocated for reserved entries. BUG: KASAN: slab-out-of-bounds in npc_map_mcam_entry_and_cntr+0xb0/0x1a0 Write of size 2 at addr ffff0001033e7ffe by task kworker/0:1/14 CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 6.1.67 #1 Hardware name: Marvell CN106XX board (DT) Workqueue: events work_for_cpu_fn Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x88/0xb4 print_report+0x154/0x458 kasan_report+0xb8/0x194 __asan_store2+0x7c/0xa0 npc_map_mcam_entry_and_cntr+0xb0/0x1a0 rvu_mbox_handler_npc_mcam_write_entry+0x268/0x280 npc_install_flow+0x840/0xfe0 rvu_npc_install_cpt_pass2_entry+0x138/0x190 rvu_nix_init+0x148c/0x2880 rvu_probe+0x1800/0x30b0 local_pci_probe+0x78/0xe0 work_for_cpu_fn+0x30/0x50 process_one_work+0x4cc/0x97c worker_thread+0x360/0x630 kthread+0x1a0/0x1b0 ret_from_fork+0x10/0x20

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	55307fcb925846d760ed80f4a8359dd4331c52bd builds before 30e5ee98e86ad47c76695458987097e849d0611a; from 55307fcb925846d760ed80f4a8359dd4331c52bd before de8e3a4004c5df9461974352e9d7ff0f8313c508; 55307fcb925846d760ed80f4a8359dd4331c52bd builds before 1d072cc3ba4338d6b2acb85d50a3af5cf2b12a3e; 55307fcb925846d760ed80f4a8359dd4331c52bd builds before 2477c523c6e69733d51101ae9bd2dfc0a054b13d; from 55307fcb925846d760ed80f4a8359dd4331c52bd before f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232	CNA record

References

References

https://git.kernel.org/stable/c/30e5ee98e86ad47c76695458987097e849d0611a
https://git.kernel.org/stable/c/de8e3a4004c5df9461974352e9d7ff0f8313c508
https://git.kernel.org/stable/c/1d072cc3ba4338d6b2acb85d50a3af5cf2b12a3e
https://git.kernel.org/stable/c/2477c523c6e69733d51101ae9bd2dfc0a054b13d
https://git.kernel.org/stable/c/f9cd6fabe0e7c7f6fc30c6c192c7ed72aba37232

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.