The Linux kernel octeontx2-af driver contained a vulnerability in the rvu_mbox_handler_rep_event_notify() function, which queued a sender-controlled REP_EVENT_NOTIFY request body without validating the nested pcifunc field. This allowed a malicious VF attached to a PF in switchdev representor mode to supply an out-of-range pcifunc value, leading to an out-of-bounds write in rvu_rep_wq_handler via ether_addr_copy(). The fix involved gating requests at the handler entry with is_pf_func_valid(), a canonical range check, to prevent invalid pcifunc values from being processed.

An attacker with control over a VF could exploit this vulnerability to cause a slab-out-of-bounds write in kernel memory, potentially leading to memory corruption or system instability. No known exploits in the wild have been reported. The vulnerability affects the Linux kernel driver for Marvell octeontx2 Ethernet devices when operating in switchdev representor mode.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was resolved by adding validation checks using is_pf_func_valid() to reject malformed requests at the handler entry. Users should monitor official Linux kernel updates and apply patches that address CVE-2026-63923 once available.