Skip to content
Heist/ feed
High

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.

Announced Source revision 1
Original source ↗

CVE-2026-72045

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-72045

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "04c014e49b9f53d58a8f94adece8a0af3ae1b85c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "54535692bec9ef464adc714108eb19e49e38b5a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "c73b8795b45f4ad5a95120d2e9b435ea4616e08e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "59da37fee81a8d76079313348ca13c5bc90dd6ae",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
        "lessThan": "8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.217",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.184",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.148",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.101",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.42",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.5",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-72045

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#41846 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement