Linux Kernel EUVD-2026-59720

Exploitation requires all of the following conditions to be simultaneously true: (1) the target system runs on physical Marvell OcteonTX2 hardware; (2) SR-IOV is configured and at least one VF is assigned to an attacker-controlled workload on the same CGX LMAC as the PF; (3) the PF has configured HiGig2 parsing (NPC_RX_HIGIG_PKIND) or EDSA parsing (NPC_RX_EDSA_PKIND) - these are non-default, operator-explicitly-enabled protocol modes used in carrier and enterprise switching environments; (4) the attacker has local execution capability within the VF-assigned context (PR:L). Exploitation is limited by: the strict hardware specificity (OcteonTX2 only), the non-default network protocol configuration requirement, the local access vector, and the need for the PF to be actively using HiGig2 or EDSA. Standard Linux deployments on x86 or non-OcteonTX2 ARM hardware are entirely unaffected.

The NVD CVSS score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) correctly captures scope change (VF impacting PF-owned hardware state) but requires careful contextualization. Real-world risk is substantially lower than the raw score implies for several reasons: the attack vector is strictly local (AV:L), requiring an actor who already has VF access on the physical host; the affected hardware is Marvell OcteonTX2, specialized carrier/enterprise networking silicon not present in general-purpose server fleets; and the attack is only impactful when HiGig2 or EDSA parsing is actively enabled - a non-default, operator-specific configuration. EPSS at 0.15% (5th percentile) corroborates low exploitation interest. This vulnerability is not listed in CISA KEV, and no public exploit code has been identified. The S:C scope change is genuine and serious within the affected deployment model (multi-tenant SR-IOV on carrier networking gear), but the combination of specialized hardware, local access requirement, and non-default configuration dependency places practical exploitation risk in the low-to-medium band despite the High CVSS score. No conflicting signals exist between CVSS vector and description.

An attacker with an SR-IOV VF on an OcteonTX2 system - such as a malicious VM tenant in a carrier NFV environment - triggers a NIX LF allocation for their VF on a CGX LMAC shared with the PF. Because no PKIND authorization check exists, the VF's LF alloc resets the LMAC RX PKIND and TX parse configuration, overwriting the PF's HiGig2 or EDSA parsing setup with default values. The PF subsequently misparses ingress frames, potentially leaking packet metadata visible to the VF or causing PF-level network disruption.