Executive brief
The Linux kernel's OcteonTX2 networking hardware driver contains a flaw in a mailbox request handler that processes LMTLINE (LMT mapping table) configuration. An attacker with VF (virtual function) access can bypass authorization checks by injecting an unauthenticated payload field, allowing them to redirect their line-table mappings to other physical functions and potentially access or manipulate shared memory resources intended for other tenants.
Technical details
The vulnerability exists in rvu_mbox_handler_lmtst_tbl_setup() within the OcteonTX2 AF driver. The mailbox dispatcher validates the caller's pcifunc (authenticated from IRQ source), but the payload field req->base_pcifunc is not sanitized before being used as a direct index into the LMT map table. This allows a VF caller to read and copy arbitrary functions' LMTLINE physical addresses. The root cause is a logic flaw in input validation: VF callers are not restricted to their own PF's function space. The fix adds validation using is_pf_func_valid() to ensure that when a VF requests access to another function's LMTLINE, that target function belongs to the same PF, preventing cross-PF access and returning -EPERM on violation. No user interaction is required; a local VF tenant can trigger this via mailbox requests.
Affected products
- Linux Linux kernel 5.x through 6.x (OcteonTX2-AF driver)
Timeline
- 2026-08-15: disclosed: CVE-2026-72045 published
- 2026-08-03: patched: Fix included in stable kernel updates
- 2026-07-28: other: Patch authored by Junrui Luo