CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
rvumboxhandlerlmtsttblsetup() uses req->basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->basepcifunc is a separate payload field and is not sanitized.
Reject the request with -EPERM when a VF caller's basepcifunc is not a valid function under its own PF. ispffuncvalid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72045?
CVE-2026-72045 has a risk rating of 47, indicating a medium-level severity.
How do I fix CVE-2026-72045?
To address CVE-2026-72045, ensure that your Linux kernel is updated to the latest version that resolves this vulnerability.
What systems are affected by CVE-2026-72045?
CVE-2026-72045 affects specific configurations of the Linux kernel that utilize the octeontx2-af driver on supported hardware.
What are the potential impacts of CVE-2026-72045?
Exploitation of CVE-2026-72045 could allow one virtual function (VF) to access the resources of another virtual function, leading to potential data leakage.
When was CVE-2026-72045 published?
CVE-2026-72045 was published on August 15, 2026.