CVE-2026-90085 PUBLISHED

octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: fix NULL deref in NIX TM tree debugfs read path

rvu_dbg_nix_tm_tree_display() dereferences pfvf->sq_ctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF whose transmit queues are not set up triggers a kernel oops.

Guard the read path the same way rvu_dbg_nix_tm_tree_write() already does and return -EINVAL with a seq_file message when sq_ctx is NULL.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from b907194a5d5bcd3b01d28d095f6a4d9fcd9c5354 to fb736d733b0a60377cf53010571c261886446fd5 (excl.)
  • affected from b907194a5d5bcd3b01d28d095f6a4d9fcd9c5354 to 537e11a1700f64dc6754108f0e1333ad63d4f548 (excl.)
  • affected from b907194a5d5bcd3b01d28d095f6a4d9fcd9c5354 to fdf7358e2688f12eff41290bc45030b7aff0845e (excl.)
  • affected from b907194a5d5bcd3b01d28d095f6a4d9fcd9c5354 to ec65631bd5ec251cdf67a4919fac7a3149a6e235 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.11 is affected
  • unaffected from 0 to 6.11 (excl.)
  • unaffected from 6.12.110 to 6.12.* (incl.)
  • unaffected from 6.18.52 to 6.18.* (incl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References