CVE-2026-72410
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Validate NIX maximum LFs correctly
NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is incorrect. This patch fixes that condition.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the octeontx2-af driver within the Linux kernel, specifically concerning the validation of NIX maximum logical functions. This issue represents a privilege escalation and resource management flaw that can potentially compromise system integrity. The vulnerability manifests when administrators or users attempt to configure the maximum number of logical functions through devlink commands before any logical functions have been assigned to a physical or virtual function. The core technical flaw stems from an incorrect conditional check that fails to properly validate whether logical functions are actually assigned before allowing configuration changes.
The operational impact of this vulnerability extends beyond simple misconfiguration, as it allows for improper resource allocation and potential denial of service conditions. When the validation condition is flawed, it enables unauthorized modification of NIX maximum LF parameters regardless of current assignment status, creating opportunities for malicious actors to manipulate hardware resource allocation. This flaw directly affects the kernel's device management capabilities and can lead to system instability when logical functions are improperly configured or when resource limits exceed available hardware capacity. The vulnerability aligns with CWE-284 access control weakness patterns and represents a failure in proper input validation and state checking mechanisms.
From an attack perspective, this vulnerability can be leveraged through privilege escalation techniques that exploit the improper validation logic in device management. The flaw enables attackers to modify resource limits before assignments are properly established, potentially leading to resource exhaustion or system crashes when the incorrect configuration is subsequently applied. The octeontx2-af driver's handling of devlink commands becomes a vector for manipulation, allowing adversaries to bypass normal assignment procedures and create inconsistent system states. This vulnerability impacts systems utilizing Cavium OcteonTX2 network adapters and can be classified under ATT&CK technique T1068 privilege escalation through local resource manipulation.
The patch addresses the root cause by correcting the conditional validation logic that determines whether logical functions have been assigned before allowing modification of maximum LF parameters. This fix ensures proper state checking before configuration changes are permitted, preventing invalid parameter modifications when no assignments exist. The solution aligns with security best practices for device driver development and proper resource management within kernel space. System administrators should ensure immediate patch deployment to protect against potential exploitation, particularly in environments where privileged device configuration commands are frequently used or where multiple administrators may interact with hardware resources. The corrected validation mechanism now properly enforces assignment state checks before allowing parameter modifications, thereby maintaining system stability and preventing unauthorized resource manipulation through the devlink interface.