CVE-2026-64225

octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

State: Published
Severity: Not scored
Published: Jul 24, 2026
Updated: Jul 24, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

cgx_speed_mbps has 13 elements but RESP_LINKSTAT_SPEED can yield values 0-15. If it returns a value >= 13, this causes an out-of-bounds array access. Add a bounds check and default to speed 0 if the index is out of range.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 94071141f00bc414e8f8f7f5db3b5143d535299fAffected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 985b5e38ac4f4d5ff03c8bfd8484353b440a1579Affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 93d3dc81098cd60fb74d434ba7985ddfd9de5acbAffected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before e043017ac429caee73bd30c5a725659f1a3a4568Affected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 8201bf45cc7c1c1a09290c4db8ab1e19801f8fecAffected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 47a4cf2229be379cf88f92e32e1240337cd6273fAffected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 2c3d26b4a62454945ba9ef3af3174d3e40e7afefAffected 61071a871ea6eb2125ece91c1a0dbb124a318c8a to before c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 94071141f00bc414e8f8f7f5db3b5143d535299fAffected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 985b5e38ac4f4d5ff03c8bfd8484353b440a1579Affected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 93d3dc81098cd60fb74d434ba7985ddfd9de5acbAffected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before e043017ac429caee73bd30c5a725659f1a3a4568Affected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 8201bf45cc7c1c1a09290c4db8ab1e19801f8fecAffected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 47a4cf2229be379cf88f92e32e1240337cd6273fAffected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before 2c3d26b4a62454945ba9ef3af3174d3e40e7afefAffected
61071a871ea6eb2125ece91c1a0dbb124a318c8a to before c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.