Linux Kernel EUVD-2026-59211

The vulnerability resides in the Linux kernel's octeontx2-af driver, which manages the Resource Virtualization Unit (RVU) on Marvell OcteonTX2 (CN10K family) SoCs used in network infrastructure appliances. In SR-IOV deployments, Virtual Functions communicate with the Physical Function via a mailbox (mbox) mechanism. When a VF calls nix_set_rx_mode with both promiscuous and all_multi flags cleared - the default state during normal interface bring-up - the kernel-side RVU mbox handler invokes rvu_npc_enable_promisc_entry() and rvu_npc_enable_allmulti_entry() without verifying whether the originating request is from a VF using the is_vf() predicate. The NPC (Network Packet Classifier) MCAM (Match-and-Count Action Manager) is the hardware rule table governing which traffic the PF receives; entries deleted by this bug belong to the PF, not the VF. No CWE was formally assigned by NVD, but the root cause is functionally equivalent to CWE-269 (Improper Privilege Management): the mbox dispatch path grants VF-originating requests the same authority over PF MCAM state as PF-originating requests. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the kernel broadly; the exploitable surface is limited to hosts with the octeontx2-af module loaded.