CVE-2026-72312 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: fix VF bringup affecting PF promiscuous state
Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. This occurs because the APIs that enable/disable these rules operate only on the PF, even when the mbox request is made via a VF interface.
Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the octeontx2 network driver within the Linux kernel, specifically affecting the relationship between virtual functions and physical functions in hardware-assisted networking environments. The issue stems from improper mailbox handling during virtual function interface management operations that directly impacts the promiscuous state of the parent physical function. When a virtual function sends a mailbox request to configure its receive mode with both promiscuous and allmulti flags set to false, the underlying driver logic incorrectly interprets this as a command to modify the parent physical function's multicast address table rules. This misinterpretation occurs because the APIs responsible for enabling or disabling promiscuous and allmulti entries operate exclusively on the physical function context regardless of whether the mailbox request originates from a virtual function interface.
The technical flaw manifests through a critical design oversight in the driver's mailbox processing logic where the rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() functions lack proper context validation. These functions do not distinguish between operations initiated by the physical function itself versus those forwarded through virtual function interfaces, leading to unintended side effects on the parent function's network configuration state. The vulnerability specifically affects the MCAM (Multicast CAM) rule management system where promiscuous and allmulti entries are maintained in separate table entries that can be individually enabled or disabled. When a virtual function brings up or tears down its interface, the driver processes these operations without checking if they originate from a virtual function context, causing the physical function's MCAM rules to be inadvertently cleared.
The operational impact of this vulnerability extends beyond simple network configuration disruption to potentially compromise network security and availability in multi-tenant environments. An attacker controlling a virtual function could exploit this weakness to temporarily disable promiscuous mode on the parent physical function, thereby reducing network monitoring capabilities and potentially enabling stealthy network reconnaissance activities. This presents a significant concern in data center and cloud computing environments where network visibility is crucial for security operations and compliance requirements. The vulnerability also affects systems using hardware-assisted virtualization where multiple virtual machines share the same physical network interface card, as it could lead to unauthorized network access patterns or bypass of security controls that rely on promiscuous mode functionality.
The mitigation strategy requires implementing proper context validation within the driver's mailbox handling code by adding is_vf() checks before executing disable operations on promiscuous and allmulti MCAM rules. This approach aligns with the principle of least privilege and prevents virtual functions from directly manipulating physical function resources without explicit authorization. The fix ensures that only legitimate physical function operations can modify the parent interface's multicast address table entries, while virtual function operations are properly isolated to their own resource management contexts. This solution addresses the underlying CWE-284 access control weakness where insufficient privilege checking allows unauthorized modification of protected system resources and aligns with ATT&CK technique T1070.004 for bypassing security controls through privilege escalation in network device drivers.
The vulnerability demonstrates a fundamental flaw in how virtualization-aware network drivers handle shared resource management, particularly when dealing with hardware-assisted networking features that provide promiscuous mode capabilities. It highlights the importance of maintaining clear boundaries between virtual and physical function operations in modern network stack implementations, where improper abstraction can lead to security implications beyond simple configuration errors. The fix reinforces proper separation of concerns in driver architecture by ensuring that virtual function interface management does not inadvertently affect parent physical function network state, thereby preserving the integrity of shared hardware resources in multi-tenant networking environments. This type of vulnerability represents a classic example of how complex virtualization features can introduce unexpected security implications when not properly validated against resource access control boundaries.