Skip to main content

Linux Kernel CVE-2026-74527

| EUVDEUVD-2026-59720 HIGH
2026-08-15 Linux GHSA-vg39-x84f-cgrf
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

AV:L and PR:L because exploitation requires local VF execution; S:C because VF corrupts PF-owned shared hardware state across the privilege boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:09 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Block VFs from clobbering special CGX PKIND state

PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup.

Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.

AnalysisAI

Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain VF assignment on shared CGX LMAC
Delivery
Initiate NIX LF alloc from VF context
Exploit
VF issues cgx_set_pkind() without authorization check
Execution
LMAC RX PKIND reset to default, overwriting PF HiGig2/EDSA config
Persist
PF misparsing exposes frame metadata or disrupts packet forwarding
Impact
VF observes cross-tenant traffic artifacts or causes PF network outage
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following conditions to be simultaneously true: (1) the target system runs on physical Marvell OcteonTX2 hardware; (2) SR-IOV is configured and at least one VF is assigned to an attacker-controlled workload on the same CGX LMAC as the PF; (3) the PF has configured HiGig2 parsing (NPC_RX_HIGIG_PKIND) or EDSA parsing (NPC_RX_EDSA_PKIND) - these are non-default, operator-explicitly-enabled protocol modes used in carrier and enterprise switching environments; (4) the attacker has local execution capability within the VF-assigned context (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) correctly captures scope change (VF impacting PF-owned hardware state) but requires careful contextualization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with an SR-IOV VF on an OcteonTX2 system - such as a malicious VM tenant in a carrier NFV environment - triggers a NIX LF allocation for their VF on a CGX LMAC shared with the PF. Because no PKIND authorization check exists, the VF's LF alloc resets the LMAC RX PKIND and TX parse configuration, overwriting the PF's HiGig2 or EDSA parsing setup with default values. …
Remediation Upgrade to Linux kernel 7.1.8 (stable branch) or 7.2-rc6 (mainline), which introduce the authorization checks `cgx_get_pkind()` and `rvu_cgx_is_pkind_config_permitted()` to block VF PKIND resets. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, determine whether your organization operates Marvell OcteonTX2 hardware in SR-IOV multi-tenant configurations; if not, no action required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74527 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy