Linux kernel CVE-2026-72329

Requires a host running the Linux liquidio PF driver on Marvell/Cavium LiquidIO/OCTEON SmartNIC hardware with SR-IOV enabled and at least one VF assigned to an attacker-controlled context (e.g., a passthrough guest). The specific trigger is an OCTEON_VF_FLR_REQUEST mailbox message on the DPI ring after the cached VF pci_dev pointer in dpiring_to_vfpcidev_lut[] has gone stale (VF removed/reprobed). Limiting factors: exploitation is local/adjacent to the host via the VF (not network-remote), needs the exact LiquidIO hardware and SR-IOV configuration (non-default for most deployments), and is a use-after-free whose escalation beyond a crash depends on winning a memory-reuse race - so it is neither a default-configuration nor a trivially reliable condition.

Signals conflict and warrant scrutiny. The supplied CVSS 3.1 base score of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is unusually high for a driver UAF: it claims no privileges (PR:N) and low complexity, yet the code path is only reachable by an entity that controls an assigned VF and can send a mailbox FLR request - effectively a compromised or malicious guest, which is a privilege condition, not PR:N. Use-after-free exploitation also typically involves timing/grooming, arguing for higher attack complexity than AC:L. EPSS is low (0.20%, 10th percentile), there is no CISA KEV listing, and no public PoC is referenced - consistent with a hard-to-reach, hardware-specific bug rather than a mass-exploitation target. The realistic worst case is a hostile VF corrupting host-kernel memory (a scope-crossing VF-to-host issue, hence S:C), which is serious in multi-tenant virtualization but gated by the requirement for LiquidIO hardware with SR-IOV and VF passthrough. Net: patch on affected fleets, but this is a targeted/low-prevalence risk, not a broad internet-facing emergency; the headline 9.3 overstates real-world reachability versus the local, hardware- and configuration-dependent nature of the flaw.

In a virtualization host equipped with a Marvell/Cavium LiquidIO SmartNIC and SR-IOV enabled, an attacker who controls a guest VM with an assigned VF triggers VF removal/reprobe to leave a stale entry in the PF's dpiring_to_vfpcidev_lut[], then sends an OCTEON_VF_FLR_REQUEST over the DPI mailbox ring. The PF dereferences the dangling pci_dev and operates on freed memory, crashing the host or potentially corrupting kernel memory for escalation. No public PoC is known, and reliable exploitation requires UAF grooming plus the specific hardware.