Skip to main content

Linux Kernel EUVDEUVD-2026-59003

| CVE-2026-72045 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5g45-v3m4-8hc5
Information Disclosure Linux Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local vector confirmed by VF mailbox mechanism; PR:L because VF assignment is required; S:C because exploit crosses VF-to-PF isolation boundary; C:H/I:H for physical address leak enabling cross-PF memory access.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:27 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.

Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.

AnalysisAI

Cross-VF/PF LMTLINE physical address disclosure in the Linux kernel's octeontx2-af CN10K driver allows a low-privileged VF caller to read another PF's LMTLINE physical base address and map it into its own LMT table entry. Affected are Linux kernel trees from commit 893ae97214c3 across stable branches 6.6.x before 6.6.148, 6.12.x before 6.12.101, 6.18.x before 6.18.42, and mainline before 7.1.5/7.2-rc1. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.20% (10th percentile) indicates low exploitation probability, consistent with the hardware-specific attack surface.

Technical ContextAI

The octeontx2-af (OcteonTX2 Admin Function) driver manages Marvell/Cavium CN10K SoC Resource Virtualization Unit (RVU) mailbox communications between Physical Functions (PF) and Virtual Functions (VF). LMTLINE (Local Memory Transaction Line) is a Direct Store Area used for hardware-accelerated LMTST (Load-and-Store Transaction) operations, each mapped via a per-function LMT map table containing physical base addresses. The vulnerable function rvu_mbox_handler_lmtst_tbl_setup() authenticates the request source header field (req->hdr.pcifunc) against the IRQ source, but treats the payload field req->base_pcifunc as a trusted index into the global LMT map table without bounds-checking it against the calling VF's own PF slot. CWE is not formally assigned, but the root cause class is improper input validation / authorization bypass (analogous to CWE-284 and CWE-20): a VF can supply an arbitrary pcifunc index to reference any PF's LMTLINE entry, crossing isolation boundaries designed to separate SR-IOV virtual functions.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 6.6.148 or later for the 6.6 LTS branch, 6.12.101 or later for the 6.12 LTS branch, 6.18.42 or later for the 6.18 branch, or 7.1.5 / 7.2-rc1 or later for mainline. Individual fix commits can be cherry-picked from the kernel stable git tree at the URLs listed above for backports to other maintained distributions. If an immediate kernel update is not feasible on CN10K/OcteonTX2-based systems, a compensating control is to prevent untrusted VF assignment: restrict SR-IOV VF passthrough to trusted tenants only, as exploitation requires a caller with VF access. Disabling the octeontx2-af driver module entirely would eliminate the attack surface at the cost of losing CN10K RVU functionality. There are no known workarounds that preserve full VF sharing while mitigating the input validation gap.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59003 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy