octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
Published Aug 15, 2026
8.8
HIGHCVSS 3.1
EPSS 0.17%
Description
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.
Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.14StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.14
- Version 5.15.217StatusunaffectedConstraints<=5.15.*
- Version 6.1.184StatusunaffectedConstraints<=6.1.*
- Version 6.12.101StatusunaffectedConstraints<=6.12.*
- Version 6.18.42StatusunaffectedConstraints<=6.18.*
- Version 6.6.148StatusunaffectedConstraints<=6.6.*
- Version 7.1.5StatusunaffectedConstraints<=7.1.*
- Version 7.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
Red Hat Enterprise Linux 9
kernel-0:5.14.0-687.48.1.el9_8
Fixed · RHSA-2026:67470
Red Hat Enterprise Linux 9
kernel-0:5.14.0-687.48.1.el9_8
Fixed · RHSA-2026:67470
Red Hat Enterprise Linux 10
kernel
Affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-687.48.1.el9_8 | Fixed | RHSA-2026:67470 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-687.48.1.el9_8 | Fixed | RHSA-2026:67470 |
| Red Hat Enterprise Linux 10 | kernel | Affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (12)
- https://access.redhat.com/security/cve/CVE-2026-72045 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2516639 Issue Tracking
- https://git.kernel.org/stable/c/04c014e49b9f53d58a8f94adece8a0af3ae1b85c
- https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2
- https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae
- https://git.kernel.org/stable/c/6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed
- https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915
- https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e
- https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11
- https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72045-21ac@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2026-72045
- https://www.cve.org/CVERecord?id=CVE-2026-72045
Change history (0)
No recorded changes yet.