Skip to main content

Linux kernel EUVDEUVD-2026-59228

| CVE-2026-72329 CRITICAL
2026-08-15 Linux GHSA-5c72-mrqj-9c57
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.3 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.3 CRITICAL
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Reachable only by an entity controlling an assigned VF (PR:L), exploitation needs UAF timing (AC:H), and a hostile VF corrupting host kernel memory is a scope change (S:C).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
CRITICAL
qualitative
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:28 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.3 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
CRITICAL 9.3
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/liquidio: drop cached VF pci_dev LUT

The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.

Replace the cached VF mapping with runtime lookup on the mailbox DPI ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup.

AnalysisAI

Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.

Technical ContextAI

The bug lives in the LiquidIO Ethernet driver's PF SR-IOV enablement path. When SR-IOV is enabled, the PF walks the PCI bus with pci_get_device() to populate dpiring_to_vfpcidev_lut[], a lookup table mapping DPI mailbox rings to VF pci_dev structures. The pci_get_device() iterator drops the reference on the previously returned device at each step, so the pointers stored in the table never own a reference and can become dangling once the underlying VF is removed or reprobed. Later, during OCTEON_VF_FLR_REQUEST mailbox handling, the driver dereferences the cached (now stale) pointer and issues a function-level reset against it. This is a classic use-after-free / dangling-pointer dereference (CWE-416; the feed lists CWE as N/A). The fix removes the cached LUT entirely and instead performs a runtime lookup: it derives the VF index from q_no, resolves the VF through exported PCI IOV helpers, validates it against the PF pointer and VF ID, calls pcie_flr(), then releases the reference with pci_dev_put().

RemediationAI

Apply the upstream stable fix: update to a kernel containing commits 81acef3a247fd523513a2e9f71de1c167bc0f882 / 5c0e3ba4f500fd4314ceb42f07f16bc445156431 (fix present in mainline 7.2-rc3 and backported to the 7.1.x stable series, referenced as 7.1.5). Vendor-released patch confirmed via git.kernel.org; consume your distribution's corresponding patched kernel package rather than hand-picking commits. If you cannot patch immediately, reduce exposure by not enabling SR-IOV on LiquidIO adapters (avoid echo N > /sys/class/net/<if>/device/sriov_numvfs provisioning) or by not passing liquidio VFs through to untrusted guests - the trade-off is loss of hardware VF acceleration for those tenants. Where the hardware is not required, blacklisting/unloading the liquidio module removes the code path entirely at the cost of that NIC's functionality. Advisory/patch URLs: https://git.kernel.org/stable/c/81acef3a247fd523513a2e9f71de1c167bc0f882 and https://git.kernel.org/stable/c/5c0e3ba4f500fd4314ceb42f07f16bc445156431.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy