« Volver al listado

CVE-2026-72045

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.

Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L, PR:L sin UI indica escalada local. El bug permite a un VF no sanitizado acceder a LMTLINE de otra función bajo su PF, escalando permisos e leyendo memoria física ajena.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update SoftwareRestrict File and Directory PermissionsPrivileged Account ManagementOperating System ConfigurationExecution PreventionAudit

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72045",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "04c014e49b9f53d58a8f94adece8a0af3ae1b85c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "54535692bec9ef464adc714108eb19e49e38b5a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "c73b8795b45f4ad5a95120d2e9b435ea4616e08e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "59da37fee81a8d76079313348ca13c5bc90dd6ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "lessThan": "8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:13.700",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/04c014e49b9f53d58a8f94adece8a0af3ae1b85c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF\n\nrvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct\nindex into the LMT map table to read another function's LMTLINE\nphysical base address and copy it into the caller's own LMT map table\nentry. The mailbox dispatcher authenticates req->hdr.pcifunc from the\nIRQ source, but req->base_pcifunc is a separate payload field and is\nnot sanitized.\n\nReject the request with -EPERM when a VF caller's base_pcifunc is not a\nvalid function under its own PF. is_pf_func_valid() bounds the FUNC field\nto the PF's configured VF count, keeping the computed index inside the\ncaller's own slot block."
    }
  ],
  "lastModified": "2026-08-23T13:16:38.160",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}