CVE-2026-74527 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Block VFs from clobbering special CGX PKIND state
PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup.
Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's octeontx2 network driver where a privilege escalation risk occurs through improper handling of virtual function (VF) access to shared hardware resources. The issue stems from the fact that both physical functions (PFs) and virtual functions within the same CGX LMAC must share the same hardware PKIND programming configuration, creating a scenario where VFs could inadvertently overwrite critical parsing settings established by the PF. This particular flaw represents a breakdown in resource isolation mechanisms that should prevent lower-privileged VFs from modifying hardware states that affect the entire shared LMAC interface.
The technical implementation flaw manifests when HiGig2 or EDSA parsing modes are enabled within the network infrastructure. Under these conditions, the VF allocation process attempts to reset the LMAC RX PKIND configuration and default TX parse settings, effectively overwriting the PF's carefully configured hardware state. This behavior violates fundamental principles of device virtualization where VFs should operate within defined boundaries without disrupting the parent function's configuration. The vulnerability specifically targets the NIX (Network Interface eXtension) subsystem where both PF and VF NIX logical functions (LFs) interact with shared CGX LMAC resources, creating an attack surface where malicious or misconfigured VFs could compromise network packet processing integrity.
The operational impact of this vulnerability extends beyond simple configuration conflicts to potentially disrupt network communications and create security boundaries that should not exist. When a VF resets the PKIND configuration, it can affect packet classification, parsing behavior, and ultimately network traffic flow for all LFs sharing that LMAC interface. This creates a scenario where an unprivileged VF could effectively corrupt the network processing pipeline, leading to potential data loss, traffic redirection, or even complete network interface dysfunction. The vulnerability directly impacts the integrity of hardware-assisted packet processing and violates core security principles established in the Linux kernel's device driver framework where privilege separation must be maintained between PFs and VFs.
The mitigation strategy involves implementing new kernel functions including cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() to establish proper permission checks before allowing VF operations to modify PKIND configurations. These checks specifically prevent VFs from executing cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is configured with NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND modes. This solution aligns with the principle of least privilege as defined in security standards such as CWE-276 and follows ATT&CK framework concepts related to privilege escalation and defense evasion. The implementation ensures that only authorized PF contexts can modify critical hardware parsing configurations while VFs remain restricted from overwriting shared state, thereby maintaining the integrity of the network infrastructure's packet processing pipeline.
The vulnerability demonstrates a clear failure in the Linux kernel's virtualization security model for network devices, where proper resource isolation mechanisms were not adequately enforced. This type of flaw represents a common challenge in hardware-assisted virtualization environments where multiple logical functions must share physical resources while maintaining security boundaries. The fix addresses this gap by implementing explicit permission checks that prevent VFs from accessing shared hardware configuration spaces when those configurations are in use for specific parsing modes, thereby preventing unauthorized modifications that could compromise network functionality and security posture.