Executive brief
A logic error in the Linux kernel's Marvell OcteonTX2 network adapter firmware driver allows administrators to incorrectly resize the maximum number of network interface logical functions before proper resource allocation checks are performed. This could lead to denial of service or resource exhaustion if an attacker with local administrative access triggers the vulnerability by manipulating devlink parameters, bypassing intended safeguards against concurrent or incorrect resource configuration.
Technical details
The vulnerability is an input validation flaw in the octeontx2-af driver's rvu_af_dl_nix_maxlf_validate() function. The original code incorrectly checked MCAM (NPC Memory CAM) entry allocation status instead of NIX logical function (LF) assignment status when validating whether the maximum number of NIX LFs could be modified. The vulnerable condition allowed modification of NIX LF limits even when LFs had already been assigned to physical or virtual functions. An attacker with local administrative access via the devlink command interface can bypass the intended protection that prevents modifying LF counts after initial PF/VF attachment requests. The fix replaces the MCAM check with proper NIX block iteration and free LF counting to correctly detect if any LFs have been allocated. Patches are available in kernel stable trees.
Affected products
- Linux Linux kernel 5.16 through 6.10+ (octeontx2-af driver affected in multiple kernel versions)
Timeline
- 2026-08-15: disclosed: CVE-2026-72410 published
- 2026-06-24: patched: Upstream patch merged by Jakub Kicinski
- 2026-07-24: patched: Patch backported to stable kernel trees