{"cve":"CVE-2026-90079","nvd":{"published":"2026-09-17T17:16:57.210","modified":"2026-10-19T09:18:56.767","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()\n\nrvu_mbox_init() is called separately for AF-PF mailboxes during probe\nand for AF-VF mailboxes when SR-IOV is enabled.  Each call used to\nallocate a new ng_rvu object, leaking the first allocation when the\npointer was overwritten on the second call.\n\nSharing one ng_rvu across both paths exposed several teardown bugs:\nthe error path freed all cn20k mailbox DMA and kfree()d ng_rvu even\nwhen only the failing init type should be unwound, leaving live AF-PF\nmailbox memory in use after an AF-VF init failure.  mutex_init() was\nalso re-run on the AF-VF path while AF-PF mailbox handlers could still\nhold rvu->mbox_lock.  Probe and SR-IOV failure paths did not release\ncn20k mailbox DMA either, since cleanup only happened in rvu_remove().\n\nAllocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the\nsame block, unwind only the mailbox memory for the failing init type,\nand free cn20k mailbox DMA from the probe and pci_enable_sriov()\nerror paths.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/3b11a77f69980932c3924054d66e565c9a135747","https://git.kernel.org/stable/c/a0fcbea79f034f49bdd44915f28938922023458d","https://git.kernel.org/stable/c/c08314f91782983d67af0807ed1360e404ac4a8b"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90079","score":0.00206,"percentile":0.10591,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}