A defect in the Marvell Octeon TX2 Ethernet driver allows a representor mode virtual function to send a mailbox message whose body contains a PCI function number that is out of bounds. Because the driver forwards the nested body field without performing a bounds check, the out‑of-range value causes an out‑of‑bounds write in the kernel. The memory corruption is triggered when an event such as RVU_EVENT_MAC_ADDR_CHANGE is processed, overwriting a six‑byte location used by ether_addr_copy, which can lead to a kernel panic or arbitrary memory modification. The issue is an improper array index validation, which the kernel would interpret as a serious reliability and security flaw.

Linux kernel systems that include the Marvell Octeon TX2 AF driver, specifically the code in drivers/net/ethernet/marvell/octeontx2/af/rvu_rep.c. The vulnerability exists in any kernel build that contains the unpatched implementation of rvu_mbox_handler_rep_event_notify and the corresponding mailbox handlers for representor mode VFs.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1%, suggesting low current exploitation activity, and it is not listed in the CISA KEV catalog. An attacker must control a virtual function attached to a physical function that is in switchdev representor mode and send a crafted mailbox request with an out‑of‑range PCI function number. This local or privilege‑dependent attack path can cause a kernel panic or provide a foothold for privilege escalation to root.