Skip to main content

Linux Kernel CVE-2026-64225

| EUVDEUVD-2026-48633 HIGH
Improper Validation of Array Index (CWE-129)
2026-07-24 Linux GHSA-wpwr-3cwm-vhj2
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only attack gated on OcteonTX2 hardware; low privileges needed to interact with driver; kernel memory impact justifies C:H/I:H/A:H if corruption is exploitable.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 02:31 vuln.today
CVSS changed
Aug 12, 2026 - 00:22 NVD
7.8 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.

AnalysisAI

Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The cgx_speed_mbps array holds 13 entries (indices 0-12) but the RESP_LINKSTAT_SPEED firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.

Technical ContextAI

The affected code resides in the octeontx2-af kernel driver, which manages the CGX (Common General eXtension) interface for Marvell OcteonTX2 ARM64 SoCs - specialized processors used in high-performance networking and telecom infrastructure. The driver parses a RESP_LINKSTAT_SPEED value returned by the hardware firmware to index directly into the cgx_speed_mbps[] array. CWE-129 (Improper Validation of Array Index) precisely describes the root cause: no bounds check is performed before the array dereference, so firmware-returned values of 13, 14, or 15 read adjacent kernel memory beyond the allocated array. The CPE cpe:2.3:a:linux:linux:* reflects broad applicability across kernel versions, but practical exposure is gated on the presence of OcteonTX2 hardware and the loaded driver.

RemediationAI

The primary fix is upgrading to a patched kernel stable release: 5.10.259+, 5.15.210+, 6.1.176+, 6.6.143+, 6.12.92+, 6.18.34+, 7.0.11+, or 7.1+. Upstream fix commits are published on kernel.org stable (see https://git.kernel.org/stable/c/94071141f00bc414e8f8f7f5db3b5143d535299f and related commits in references). Ubuntu users should apply USN-8618-1 via standard package management. As a compensating control where patching is not immediately feasible, blacklisting the octeontx2-af kernel module with echo 'blacklist octeontx2-af' >> /etc/modprobe.d/blacklist.conf && modprobe -r octeontx2-af eliminates the attack surface entirely but disables CGX network management for OcteonTX2 hardware; this trade-off is only acceptable if alternative management paths exist. No workaround addresses the root cause without removing the driver.

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64225 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy