Technical impact
In the Linux kernel, the octeontx2-af accelerator firmware driver was found to leave a hardware block revision register (RVUM) uncleared during shutdown. When a system performs a kexec reboot without a full power cycle, the peripheral function driver, loaded as a module, can probe before the AF driver reinitializes the hardware. The PF driver mistakenly interprets the stale RVUM value as indicating that AF has finished initializing and proceeds to access device state that is no longer valid, leading to a kernel crash. This misuse of hardware state information is a classic example of CWE‑909 – Race Condition Between User and Kernel Code. The resulting crash denies service to all users and processes relying on the kernel.
Affected Systems
All Linux kernels that include the octeontx2-af accelerator firmware driver and a PF driver compiled as separate modules are potentially affected. The crash occurs only when a kexec reboot is performed without a full power cycle, so any system using these drivers and enabling kexec without full hardware reset is at risk. No specific kernel release identified, therefore all comparable builds that load these modules should treat themselves as impacted.
Risk and Exploitability
The CVSS score of 5.5 indicates a moderate severity. The EPSS score of 0.00032 (expressed as < 1%) indicates a very low but nonzero probability that the vulnerability will be actively exploited, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not yet widespread. The likely attack vector requires privileged access to invoke kexec, which is typically restricted to root or non‑privileged kernel executables. Therefore, while exploitation could be achieved by a local attacker with sufficient privileges, the overall risk to the general population remains moderate. Nonetheless, the potential for a denial of service event warrants prompt remediation.
Ubuntu USN