GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72312 (GCVE-0-2026-72312)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
octeontx2-af: fix VF bringup affecting PF promiscuous state
Summary
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the mbox request is made via a VF interface. Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules.
Severity
7.9 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c (git)
Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < 212c59e5e416859579272288fd325148fc316109 (git)
Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < 53e17d9ed779ad25870abb9c31bc294c71a2278c (git)
Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < 3de77d2f34c2bc2acaedabc2c5e0a561b85c283a (git)
Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < 3cf83432e0561aef6d7ec2664909d12d0ff0ffc1 (git)
Affected: 967db3529ecac305d230aa4e60abddf6ab63543a , < fabb881df322da25442f98d23f5fa371e3c78ec4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            },
            {
              "lessThan": "212c59e5e416859579272288fd325148fc316109",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            },
            {
              "lessThan": "53e17d9ed779ad25870abb9c31bc294c71a2278c",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            },
            {
              "lessThan": "3de77d2f34c2bc2acaedabc2c5e0a561b85c283a",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            },
            {
              "lessThan": "3cf83432e0561aef6d7ec2664909d12d0ff0ffc1",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            },
            {
              "lessThan": "fabb881df322da25442f98d23f5fa371e3c78ec4",
              "status": "affected",
              "version": "967db3529ecac305d230aa4e60abddf6ab63543a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: fix VF bringup affecting PF promiscuous state\n\nMbox handling of nix_set_rx_mode for a VF with promiscuous and\nall_multi flags set to false causes deletion of the PF\u0027s promiscuous\nand allmulti MCAM rules. This occurs because the APIs that\nenable/disable these rules operate only on the PF, even when the\nmbox request is made via a VF interface.\n\nGuard both rvu_npc_enable_allmulti_entry() and\nrvu_npc_enable_promisc_entry() disable paths with an is_vf() check so\nthat a VF bringing up or tearing down its interface cannot inadvertently\nclear the PF\u0027s MCAM rules."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local control of an SR-IOV VF netdev on Marvell OcteonTX2/CN10K hardware; the bug is triggered via the VF driver\u0027s mailbox to the AF (rvu_mbox_handler_nix_set_rx_mode), not by remote packet delivery.\nAC:L - An attacker with VF netdev access can reliably trigger the flaw by bringing the interface up/down or changing rx_mode (e.g., ip link set up), which sends NIX_SET_RX_MODE with promisc/allmulti cleared; no race or victim timing is required.\nPR:L - Only guest/namespace CAP_NET_ADMIN (or equivalent root in an SR-IOV-assigned VM) is needed to manage the VF netdev; host init-namespace root is not required and user namespaces cannot reach this hardware path without the VF device.\nUI:N - No victim interaction is needed; the attacker initiates VF interface bringup/teardown or rx_mode updates that invoke otx2_do_set_rx_mode/otx2vf_do_set_rx_mode and the AF mbox handler.\nS:C - A VF tenant can alter PF-side NPC MCAM promiscuous/allmulti rules (rvu_npc_enable_promisc_entry/rvu_npc_enable_allmulti_entry mask pcifunc to the PF), crossing the SR-IOV isolation boundary between guest/tenant and host/provider packet filtering.\nC:L - Disabling the PF promiscuous/allmulti MCAM entries can blind host IDS/tcpdump and other monitoring that depends on promiscuous reception, reducing visibility into network traffic on the affected PF (limited confidentiality impact, not arbitrary kernel memory read).\nI:L - The VF causes unauthorized modification of host-side hardware packet-filter state by disabling PF MCAM promisc/allmulti rules; this is limited integrity impact on network policy rather than arbitrary memory or code execution.\nA:H - Clearing PF promiscuous and allmulti MCAM rules can break or degrade PF multicast delivery and promiscuous capture/monitoring on internet-facing cloud/edge servers using these NICs, and can be repeated by cycling the VF interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:39.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/212c59e5e416859579272288fd325148fc316109"
        },
        {
          "url": "https://git.kernel.org/stable/c/53e17d9ed779ad25870abb9c31bc294c71a2278c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3de77d2f34c2bc2acaedabc2c5e0a561b85c283a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cf83432e0561aef6d7ec2664909d12d0ff0ffc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/fabb881df322da25442f98d23f5fa371e3c78ec4"
        }
      ],
      "title": "octeontx2-af: fix VF bringup affecting PF promiscuous state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72312",
    "datePublished": "2026-08-15T05:55:27.817Z",
    "dateReserved": "2026-08-09T03:40:39.918Z",
    "dateUpdated": "2026-08-17T05:42:39.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72312",
      "date": "2026-09-17",
      "epss": "0.00154",
      "percentile": "0.04948"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72312\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:04.013\",\"lastModified\":\"2026-08-17T06:18:34.310\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteontx2-af: fix VF bringup affecting PF promiscuous state\\n\\nMbox handling of nix_set_rx_mode for a VF with promiscuous and\\nall_multi flags set to false causes deletion of the PF\u0027s promiscuous\\nand allmulti MCAM rules. This occurs because the APIs that\\nenable/disable these rules operate only on the PF, even when the\\nmbox request is made via a VF interface.\\n\\nGuard both rvu_npc_enable_allmulti_entry() and\\nrvu_npc_enable_promisc_entry() disable paths with an is_vf() check so\\nthat a VF bringing up or tearing down its interface cannot inadvertently\\nclear the PF\u0027s MCAM rules.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"212c59e5e416859579272288fd325148fc316109\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"53e17d9ed779ad25870abb9c31bc294c71a2278c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"3de77d2f34c2bc2acaedabc2c5e0a561b85c283a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"3cf83432e0561aef6d7ec2664909d12d0ff0ffc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"967db3529ecac305d230aa4e60abddf6ab63543a\",\"lessThan\":\"fabb881df322da25442f98d23f5fa371e3c78ec4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H\",\"baseScore\":7.9,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":5.3}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/212c59e5e416859579272288fd325148fc316109\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3cf83432e0561aef6d7ec2664909d12d0ff0ffc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3de77d2f34c2bc2acaedabc2c5e0a561b85c283a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/53e17d9ed779ad25870abb9c31bc294c71a2278c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fabb881df322da25442f98d23f5fa371e3c78ec4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T21:43:36+00:00",
      "cve": "CVE-2026-72312",
      "id": "CVE-2026-72312",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: octeontx2-af: fix VF bringup affecting PF promiscuous state",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72312.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:30:20Z",
      "cve": "CVE-2026-72312",
      "id": "CVE-2026-72312",
      "initial_release_date": "2026-09-01T13:30:20Z",
      "product_status:known_affected": "178",
      "product_status:known_not_affected": "184",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72312",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72312.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.