---
id: CVE-2026-72045
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

  rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
  index into the LMT map table to re…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

  rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
  index into the LMT map table to re…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
published: '2026-08-15'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72045'
references:
  - url: 'https://git.kernel.org/stable/c/04c014e49b9f53d58a8f94adece8a0af3ae1b85c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72045.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-72045'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2516639'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-72045'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72045'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72045-21ac@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:67470'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00169
epssPercentile: 0.06595
ingestedAt: '2026-08-23T13:48:07.647Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 9)
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
patched:
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_9
cwe:
  - CWE-1285
scores:
  nvd: 8.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
index into the LMT map table to read another function's LMTLINE
physical base address and copy it into the caller's own LMT map table
entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
IRQ source, but req->base_pcifunc is a separate payload field and is
not sanitized.

Reject the request with -EPERM when a VF caller's base_pcifunc is not a
valid function under its own PF. is_pf_func_valid() bounds the FUNC field
to the PF's configured VF count, keeping the computed index inside the
caller's own slot block.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67470** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67470)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72045.json)