CVE-2026-72329

net/liquidio: drop cached VF pci_dev LUT

State
Published
Severity
9.3 Critical
Published
Aug 15, 2026
Updated
Oct 30, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/liquidio: drop cached VF pci_dev LUT

The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.

Replace the cached VF mapping with runtime lookup on the mailbox DPI ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup.

Scores

CVSSScoreVectorSource
3.19.3 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before 4ec87796fadf5a631ee6513c258c0e3d9ca62f79Affected
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before e3b20de8d7c06c8f1a0ded1e52be9d282609c3daAffected
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before 1cf5c6a80adc31456f3e93b2922a2446fd63e2c4Affected
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before 08ff33dce6f91510bb296a753a232db0ca3fd3d8Affected
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before 81acef3a247fd523513a2e9f71de1c167bc0f882Affected
  • ca6139ffc67ee6ef0459f81e37894ed411083855 to before 5c0e3ba4f500fd4314ceb42f07f16bc445156431Affected
LinuxLinux
  • 4.10Affected
  • before 4.10Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.