The Linux kernel vulnerability CVE-2026-63923 involves the octeontx2-af driver's rvu_mbox_handler_rep_event_notify() function, which queues a sender-controlled REP_EVENT_NOTIFY request body without validating the nested pcifunc field. This attacker-controlled pcifunc is then used without bounds checking in functions rvu_get_pfvf(), rvu_get_pf(), and for mailbox device indexing, leading to out-of-bounds memory access. Specifically, an out-of-range pcifunc can cause an out-of-bounds write via ether_addr_copy() in the queued worker, as detected by KASAN. The vulnerability arises because the VF mailbox handler forwards all message IDs including REP_EVENT_NOTIFY without an allowlist, and the AF dispatcher only rewrites the header pcifunc, leaving the body pcifunc attacker-controlled. The fix involves rejecting malformed requests early by gating on the canonical is_pf_func_valid() function to ensure pcifunc is within valid range.

This vulnerability allows a local attacker with access to a VF attached to a PF in switchdev representor mode to cause out-of-bounds memory writes in kernel space. The CVSS score of 8.8 indicates high severity with potential for complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The out-of-bounds write could lead to kernel memory corruption, potentially resulting in privilege escalation, denial of service, or arbitrary code execution within the kernel context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved by adding validation of the pcifunc field using is_pf_func_valid() to reject malformed requests early. Until an official patch is applied, restrict access to VFs in switchdev representor mode and monitor for unusual mailbox message activity. Follow vendor advisories for updates and apply official fixes when available.