In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into the caller's own LMT map table entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.
Reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. is_pf_func_valid() bounds the FUNC field to the PF's configured VF count, keeping the computed index inside the caller's own slot block.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | No solution exists | Aug 19, 2026 | Aug 15, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-develUpgrade kernel-coreUpgrade python3-perfUpgrade perfUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade perf-debuginfoUpgrade rtlaUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernelUpgrade kernel-modules-coreUpgrade kernel-rtUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade libperf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade libperfUpgrade kernel-toolsUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-modulesUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modules-coreUpgrade rv | Sep 18, 2026 | Sep 16, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 25, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub