CVE-2026-72045

Received Received - Intake

Privilege Escalation in Linux Kernel OcteonTX2 AF Driver

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72045

EUVD

EUVD-2026-59003

Affected Vendors & Products

Vendor	Product	Version / Range
marvell	octeontx2-af	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper access control in the octeontx2-af driver for cn10k devices. The issue occurs in the rvu_mbox_handler_lmtst_tbl_setup() function, where a VF (Virtual Function) can access another function's LMTLINE physical base address through an unsanitized payload field (base_pcifunc). This allows unauthorized memory access by bypassing proper isolation between functions.

Detection Guidance

This vulnerability affects the Linux kernel's octeontx2-af driver for cn10k devices. Detection requires checking kernel logs for unauthorized LMTLINE access attempts or examining the driver's mailbox handler logs for suspicious VF-to-PF function index mismatches.

Impact Analysis

If exploited, this vulnerability could allow a malicious VF to read or modify memory belonging to other functions, potentially leading to privilege escalation, data leaks, or system crashes. It primarily affects systems using Marvell OcteonTX2 network adapters with cn10k devices running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Organizations processing sensitive data on affected systems may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Monitor kernel logs for any unauthorized access attempts related to LMTLINE table modifications. Restrict untrusted users' access to the octeontx2-af driver interfaces until patched.

Hi! I’m here to help you understand CVE-2026-72045. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70