CVE-2026-72045 - Vulnerability Details

- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

Description

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
index into the LMT map table to read another function's LMTLINE
physical base address and copy it into the caller's own LMT map table
entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
IRQ source, but req->base_pcifunc is a separate payload field and is
not sanitized.

Reject the request with -EPERM when a VF caller's base_pcifunc is not a
valid function under its own PF. is_pf_func_valid() bounds the FUNC field
to the PF's configured VF count, keeping the computed index inside the
caller's own slot block.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`893ae97214c385be02f8ec097298cc48c7f0d905`	affected	< e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11
`893ae97214c385be02f8ec097298cc48c7f0d905`	affected	< 54535692bec9ef464adc714108eb19e49e38b5a2
`893ae97214c385be02f8ec097298cc48c7f0d905`	affected	< c73b8795b45f4ad5a95120d2e9b435ea4616e08e
`893ae97214c385be02f8ec097298cc48c7f0d905`	affected	< 59da37fee81a8d76079313348ca13c5bc90dd6ae
`893ae97214c385be02f8ec097298cc48c7f0d905`	affected	< 8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[893ae97214c385be02f8ec097298cc48c7f0d905,e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11)`	affected	code_commit	—
`[893ae97214c385be02f8ec097298cc48c7f0d905,54535692bec9ef464adc714108eb19e49e38b5a2)`	affected	code_commit	—
`[893ae97214c385be02f8ec097298cc48c7f0d905,c73b8795b45f4ad5a95120d2e9b435ea4616e08e)`	affected	code_commit	—
`[893ae97214c385be02f8ec097298cc48c7f0d905,59da37fee81a8d76079313348ca13c5bc90dd6ae)`	affected	code_commit	—
`[893ae97214c385be02f8ec097298cc48c7f0d905,8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	generic	—
`[0,5.14)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2
https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae
https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915
https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e
https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11

History

Sat, 15 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-284

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.
Title		octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2 https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915 https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:04.038Z

Updated: 2026-08-15T05:52:04.038Z

Reserved: 2026-08-09T03:40:39.902Z

Link: CVE-2026-72045

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:13.700

Modified: 2026-08-15T06:21:13.700

Link: CVE-2026-72045

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T10:00:06Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-284
Improper Access Control

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object