Executive brief
The Linux kernel's VCAP (Virtual Content-Aware Processor) network driver uses shared hardware resources between multiple instances but protects them with independent locks, creating a race condition. An attacker with network access can exploit this flaw to corrupt network packet filtering rules in hardware and potentially bypass or disrupt network traffic policies on affected systems.
Technical details
This vulnerability is a race condition in the Linux kernel's VCAP (Virtual Content-Aware Processor) driver affecting Microchip sparx5 and lan969x chips. Multiple VCAP instances (IS0 and IS2) share a single Super VCAP hardware block with common cache and command registers, but each instance is protected by independent per-instance locks. A race condition occurs when concurrent access to different instances modifies the shared VCAP_SUPER_CTRL register and cache—for example, a debugfs rule dump (READ command outside rtnl lock) races with a tc-flower rule write to another instance. An attacker with network access can trigger concurrent operations that corrupt the shared cache, causing hardware entries to be written with incorrect data and network filtering rules to be corrupted or bypassed. The fix replaces per-instance locks with a single mutex in vcap_control, serializing all access through new vcap_lock/vcap_unlock helpers.
Affected products
- Linux Linux Kernel Versions prior to fix (specific versions not detailed in advisory)
Timeline
- 2026-08-15: disclosed
- other: CVE-2026-72340