---
id: "CVE-2026-98806"
kind: "vulnerability"
aliases: ["CVE-2026-98806"]
title: "Linux kernel: octeontx2 driver reads uninitialized memory on SDP VFs"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dcb", "infrastructure", "linux-kernel", "marvell", "octeontx2"]
not_affected_if: ["config-dcb-disabled", "no-octeontx2-hardware"]
published_at: "2026-10-18T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:14:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98806", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: octeontx2 driver reads uninitialized memory on SDP VFs

In the Linux kernel's octeontx2 network driver, buffer pool ID assignment dereferenced an uninitialized PFC map when DCB was enabled, which affected SDP virtual functions. The fix adds a NULL check and assigns a default ID first, so the driver no longer reads invalid memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98806

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

Previously, BPID assignment under CONFIG_DCB assumed
`queue_to_pfc_map` was always initialized. For SDP VFs this leads to
invalid memory access as it was not initialized.

This patch adds a NULL check for `queue_to_pfc_map` before
dereferencing it. Also, simplifies the logic by always assigning a
default BPID first, then conditionally overriding it if CONFIG_DCB is
enabled and the map exists.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_