CVE-2026-72045

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...

EUVD-2026-59003

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...

CVE-2026-72045 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...

CVE-2026-72045

CVE-2026-72045 : In the Linux kernel (octeontx2-af: cn10k), a VF could access another function’s LMTLINE via rvu_mbox_handler_lmtst_tbl_setup() using base_pcifunc as a direct index into the LMT map. The issue arises because base_pcifunc is not sanitized and is not bounded to the VF’s PF, allowing...

PT-2026-72234

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu mbox handler lmtst tbl setup uses req-base pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-45977

The CVE-2026-45977 issue affects the Linux kernel fbnic driver. A race in handling firmware logs can cause a use‑after‑free: fw_log is written in fbnic_fw_log_write() and can be accessed from the mailbox handler fbnic_fw_msix_intr(), but the log data is freed during IRQ/MBX teardown, potentially ...