CVE-2023-54129: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54129 is a kernel panic vulnerability in the Linux kernel's octeontx2-af driver caused by missing validation of the lmac_type_id field received from firmware. When a physical link change occurs on Marvell CN10XXX/CN103XX hardware, the firmware reports link details including lmac_type_id; if the firmware returns an invalid value, the kernel dereferences an out-of-bounds pointer in cgx_link_change_handler, triggering a NULL pointer dereference (Oops: 96000005) via strncpy. The vulnerability was published on December 24, 2025, and affects Linux kernel versions from commit 61071a871ea6 up to the respective fix commits in stable branches. No CVSS score has been assigned; the EPSS score is approximately 0.018% (Feedly, EUVD).

The root cause is improper input validation (CWE-20) in the octeontx2-af kernel driver. Upon receiving a link-change event from firmware, the cgx_link_change_handler function uses the firmware-supplied lmac_type_id as an index into an array to derive the lmac_type string without first checking whether the value is within valid bounds. When firmware returns an out-of-range lmac_type_id, the kernel attempts a strncpy using an invalid pointer, causing a kernel panic (Oops: 96000005) on ARM64 systems running Marvell CN103XX hardware. The fix adds a bounds check on lmac_type_id before it is used as an array index (Feedly, EUVD).

Successful triggering of this vulnerability results in a kernel panic (system crash), causing a complete loss of availability for the affected system. The impact is limited to systems running the affected Linux kernel on Marvell CN10XXX/CN103XX hardware with the octeontx2-af driver loaded. There is no known confidentiality or integrity impact, and no evidence of lateral movement potential; the vulnerability is a denial-of-service condition triggered by anomalous firmware behavior (Feedly).

Patches have been backported to multiple Linux stable branches: kernel 6.1.32 (commit cb5edce2), 6.2.16 (commit afd7660c), 6.3.3 (commit 5c0268b1), and 6.4 (commit 83a7f27c). Administrators running affected kernels on Marvell CN10XXX/CN103XX hardware should update to a patched stable release. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (EUVD, Feedly).