Linux Kernel EUVD-2026-45696

Exploitation requires: (1) Marvell OcteonTX2 hardware with the octeontx2-af/RVU driver in use; (2) a physical function placed into switchdev representor (eswitch) mode - a non-default configuration; (3) attacker control of a VF attached to that PF, i.e. a local low-privileged principal such as a guest/tenant (PR:L), able to issue mailbox messages; and (4) sending MBOX_MSG_REP_EVENT_NOTIFY with an out-of-range struct rep_event::pcifunc (best weaponised via the RVU_EVENT_MAC_ADDR_CHANGE path for a controlled OOB write). Limiting factors that reduce real-world risk: it is local-only (AV:L, no network reach), needs the specific OcteonTX2 driver and the non-default switchdev mode enabled, and requires an already-provisioned VF - deployments not using switchdev/DPU offload are not exposed.

Signals are consistent and point to a genuine but bounded local-privilege-escalation/DoS risk rather than an internet-facing crisis. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) correctly reflects a local, low-privilege attacker (a VF/guest) causing a scope-changing kernel-memory-corruption impact on the host AF. EPSS is low (0.19%, 9th percentile) and there is no CISA KEV listing and no public PoC, so there is no evidence of active or imminent widespread exploitation - appropriate for hardware-specific code with a small install base. The one caveat: exploitation is gated on a non-default deployment (parent PF in switchdev representor mode with a VF assigned to a semi-trusted tenant), so raw CVSS 8.8 overstates real-world reach for the typical deployment where switchdev is not enabled. Treat as a standard-priority kernel patch for the specific fleets running OcteonTX2 NICs in switchdev/DPU offload configurations; deprioritize elsewhere.

A tenant controlling a VF on a Marvell OcteonTX2 NIC whose parent PF has been placed in switchdev representor mode sends a crafted MBOX_MSG_REP_EVENT_NOTIFY message with an out-of-range event->pcifunc and a RVU_EVENT_MAC_ADDR_CHANGE event. The VF handler forwards it to the AF without an allowlist, and the queued AF worker performs a six-byte attacker-controlled out-of-bounds ether_addr_copy() write into kernel slab memory, enabling denial of service and potential privilege escalation on the host. No public PoC is currently identified, though KASAN reproduces the slab-out-of-bounds write.