SB20260816198 - Improper access control in Linux kernel octeontx2 af driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-74527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify shared packet kind configuration and disrupt network parsing behavior.

The vulnerability exists due to improper access control in the octeontx2-af CGX/NIX PKIND configuration logic when allocating or configuring a VF NIX logical function that shares a CGX LMAC with a PF using HiGig2 or EDSA parsing. A local user can allocate or configure a crafted VF NIX logical function to modify shared packet kind configuration and disrupt network parsing behavior.

Only CGX-mapped virtual functions sharing a LMAC with a physical function using special parse kinds are affected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3bd438a58e910db5dc369aa25dfed1fc95f1b596
• https://git.kernel.org/stable/c/d3c6b0f48f126a36955b3fb4154a59d0b3621d97