{"id":"CVE-2026-98806","kind":"vulnerability","aliases":["CVE-2026-98806"],"related":[],"title":"Linux kernel: octeontx2 driver reads uninitialized memory on SDP VFs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled\n\nPreviously, BPID assignment under CONFIG_DCB assumed\n`queue_to_pfc_map` was always initialized. For SDP VFs this leads to\ninvalid memory access as it was not initialized.\n\nThis patch adds a NULL check for `queue_to_pfc_map` before\ndereferencing it. Also, simplifies the logic by always assigning a\ndefault BPID first, then conditionally overriding it if CONFIG_DCB is\nenabled and the map exists.","summary":"In the Linux kernel's octeontx2 network driver, buffer pool ID assignment dereferenced an uninitialized PFC map when DCB was enabled, which affected SDP virtual functions. The fix adds a NULL check and assigns a default ID first, so the driver no longer reads invalid memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dcb","infrastructure","linux-kernel","marvell","octeontx2"],"not_affected_if":["config-dcb-disabled","no-octeontx2-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:14:59+00:00","updated_at":"2026-10-25T05:14:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:14:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: octeontx2 driver reads uninitialized memory on SDP VFs","impact":"low","summary":"In the Linux kernel's octeontx2 network driver, buffer pool ID assignment dereferenced an uninitialized PFC map when DCB was enabled, which affected SDP virtual functions. The fix adds a NULL check and assigns a default ID first, so the driver no longer reads invalid memory.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","octeontx2","marvell","dcb"],"confidence":0.5,"needs_auth":"unknown","worst_case":"invalid memory read in kernel driver; impact beyond crash unknown","analyst_note":"Check the upstream kernel commit and stable backports for fixed versions and whether the invalid read can be triggered by an unprivileged user; the NVD entry lacks a CVSS score.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-octeontx2-hardware","config-dcb-disabled"],"who_is_affected":"Systems running a Linux kernel built with CONFIG_DCB enabled that use Marvell octeontx2 (OcteonTX2) network hardware with SDP virtual functions. Standard x86 or general-purpose servers without this hardware are unlikely to be affected. The sources do not give fixed kernel versions.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000607,"input_tokens":3428,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98806':13A,16A 'access':114C 'add':52B,122C 'affect':46B 'also':134C 'alway':104C,139C 'assign':35B,57B,86C,94C,140C 'assum':98C 'aura':84C 'bpid':85C,93C,143C 'buffer':32B 'check':55B,125C 'condit':146C 'config':88C,96C,150C 'cve':11A,14A 'dcb':17B,42B,89C,97C,151C 'default':59B,142C 'dereferenc':36B,132C 'driver':4A,31B,64B 'enabl':44B,91C,153C 'exist':157C 'first':61B,144C 'fix':51B,83C 'follow':75C 'function':49B 'id':34B,60B 'infrastructur':18B 'initi':105C,119C 'invalid':68B,112C 'kernel':2A,21B,27B,73C 'lead':110C 'linux':1A,20B,26B,72C 'linux-kernel':19B 'logic':137C 'longer':66B 'map':40B,102C,130C,156C 'marvel':22B 'memori':7A,69B,113C 'network':30B 'null':54B,124C 'octeontx2':3A,23B,29B,81C 'octeontx2-pf':80C 'overrid':147C 'patch':121C 'pf':82C 'pfc':39B,101C,129C 'pool':33B 'previous':92C 'queue':99C,127C 'read':5A,67B 'resolv':79C 'sdp':9A,47B,107C 'simplifi':135C 'uniniti':6A,38B 'vfs':10A,108C 'virtual':48B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel built with CONFIG_DCB enabled that use Marvell octeontx2 (OcteonTX2) network hardware with SDP virtual functions. Standard x86 or general-purpose servers without this hardware are unlikely to be affected. The sources do not give fixed kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98806","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}