Linux Kernel CVE-2026-46249

The vulnerability resides in the octeontx2-af (OcteonTX2 Admin Function) subsystem of the Linux kernel, which manages Marvell OcteonTX2 network SoC hardware - typically found in high-performance networking and cloud infrastructure platforms. The affected CPE is cpe:2.3:a:linux:linux across multiple stable branches. The RVUM (Resource and Virtualization Unit Manager) block revision register serves as an implicit readiness signal between the AF (Admin Function) and PF (Physical Function) drivers; a non-zero value is treated by PF as proof that AF has completed hardware initialization. Under kexec - a Linux mechanism to chain-load a new kernel without a full hardware power cycle, commonly used for crash dumps (kdump) and live kernel patching - hardware registers are not reset. Because the AF driver failed to zero the RVUM block revision register at shutdown, the new kernel's PF driver reads the stale value, incorrectly assumes AF readiness, and dereferences uninitialized state. No CWE was formally assigned; the root cause class is improper hardware state cleanup on shutdown, analogous to CWE-672 (Operation on a Resource after Expiration or Release) or CWE-908 (Use of Uninitialized Resource). The fix clears the RVUM block revision during AF shutdown to break the false-positive readiness signal.