CVE-2026-72045

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.

Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
LinuxLinux	893ae97214c385be02f8ec097298cc48c7f0d905 to before 04c014e49b9f53d58a8f94adece8a0af3ae1b85cAffected 893ae97214c385be02f8ec097298cc48c7f0d905 to before 6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eedAffected 893ae97214c385be02f8ec097298cc48c7f0d905 to before e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11Affected 893ae97214c385be02f8ec097298cc48c7f0d905 to before 54535692bec9ef464adc714108eb19e49e38b5a2Affected 893ae97214c385be02f8ec097298cc48c7f0d905 to before c73b8795b45f4ad5a95120d2e9b435ea4616e08eAffected 893ae97214c385be02f8ec097298cc48c7f0d905 to before 59da37fee81a8d76079313348ca13c5bc90dd6aeAffected 893ae97214c385be02f8ec097298cc48c7f0d905 to before 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

893ae97214c385be02f8ec097298cc48c7f0d905 to before 04c014e49b9f53d58a8f94adece8a0af3ae1b85cAffected
893ae97214c385be02f8ec097298cc48c7f0d905 to before 6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eedAffected
893ae97214c385be02f8ec097298cc48c7f0d905 to before e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11Affected
893ae97214c385be02f8ec097298cc48c7f0d905 to before 54535692bec9ef464adc714108eb19e49e38b5a2Affected
893ae97214c385be02f8ec097298cc48c7f0d905 to before c73b8795b45f4ad5a95120d2e9b435ea4616e08eAffected
893ae97214c385be02f8ec097298cc48c7f0d905 to before 59da37fee81a8d76079313348ca13c5bc90dd6aeAffected
893ae97214c385be02f8ec097298cc48c7f0d905 to before 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915Affected

LinuxLinux

5.14Affected
before 5.14Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.