CVE-2026-72312
Received Received - Intake

octeontx2-af PF Promiscuous State Corruption via VF

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the mbox request is made via a VF interface. Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72312
EUVD
EUVD-2026-59211

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the octeontx2-af driver. It involves a flaw where a virtual function (VF) can unintentionally remove promiscuous and allmulti network rules configured for the physical function (PF). This happens because the APIs managing these rules do not distinguish between VF and PF operations, allowing a VF to modify PF settings via mailbox requests.

Impact Analysis

If exploited, this vulnerability could disrupt network traffic by removing critical promiscuous or multicast rules on the PF. This may lead to unauthorized network access, data leakage, or denial of service for legitimate traffic, especially in virtualized environments where VFs are commonly used.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive network traffic or enabling unauthorized access to data, which violates confidentiality requirements in standards like GDPR and HIPAA. Organizations must ensure network configurations remain secure to meet regulatory obligations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72312. The vulnerability affects the octeontx2-af driver, so ensure the driver is updated as part of the kernel update. Monitor network interface configurations to verify promiscuous and allmulti flags are not inadvertently cleared.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart