CVE-2026-72312
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel octeontx2-af driver, mbox handling for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the request comes via a VF interface. The fix adds an is_vf() check in the disable paths to prevent a VF from inadvertently clearing the PF's MCAM rules.
Risk Assessment
This can lead to loss of PF network configuration, potentially disrupting network operation or allowing unauthorized traffic.
Recommendation
Apply the kernel patch that adds an is_vf() check in the promiscuous and allmulti disable paths.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF promiscuous state Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the mbox request is made via a VF interface. Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules.