{"id":"CVE-2026-72045","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF\n\nrvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct\nindex into the LMT map table to re…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF\n\nrvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct\nindex into the LMT map table to re…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","published":"2026-08-15","updated":"2026-08-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72045","references":[{"url":"https://git.kernel.org/stable/c/04c014e49b9f53d58a8f94adece8a0af3ae1b85c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72045.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-72045"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2516639"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72045"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72045"},{"url":"https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72045-21ac@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:67470"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00169,"epssPercentile":0.06595,"ingestedAt":"2026-08-23T13:48:07.647Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 9)","affected":["enterprise_linux 10","enterprise_linux 9","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_9"],"patched":["enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_9"],"cwe":["CWE-1285"],"scores":{"nvd":8.8,"vendor":7},"slug":"CVE-2026-72045","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF\n\nrvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct\nindex into the LMT map table to read another function's LMTLINE\nphysical base address and copy it into the caller's own LMT map table\nentry. The mailbox dispatcher authenticates req->hdr.pcifunc from the\nIRQ source, but req->base_pcifunc is a separate payload field and is\nnot sanitized.\n\nReject the request with -EPERM when a VF caller's base_pcifunc is not a\nvalid function under its own PF. is_pf_func_valid() bounds the FUNC field\nto the PF's configured VF count, keeping the computed index inside the\ncaller's own slot block.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:67470** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67470)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72045.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}