SB20260815314 - Improper input validation in Linux kernel octeontx2 af driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-72410)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to modify NIX maximum logical function settings in an invalid state.

The vulnerability exists due to improper input validation in the devlink NIX maximum LF validation logic in rvu_devlink.c when handling devlink commands before or during NIX LF assignment. A local privileged user can issue a devlink command to modify NIX maximum LF settings in an invalid state.

The issue affects the octeontx2-af driver logic that is intended to permit resizing only before any LF attach requests from PFs and VFs and not later or concurrently.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0933fe0130eb71af0c3ab481b40f543b458a8c54
• https://git.kernel.org/stable/c/1576d12a39860418d6a68b402fda71a48f04a57c
• https://git.kernel.org/stable/c/b1f6381acf9d55fab208e8b4c252a5a671820bd9
• https://git.kernel.org/stable/c/e0ac054416bf4e913fe96cefefe94e3331bbe6fa