← News
/DISPATCH · 2026-08-16

Linux kernel octeontx2-af: CVSS 9.9 privilege CVE-2026-72045 and allocation CVE-2026-72050, bulk disclosure 15 Aug 2026

On 15 Aug 2026, mainline Linux disclosed two independent defects in the Marvell OcteonTX NIC driver octeontx2-af: CVE-2026-72045 hits rvu_mbox_handler_lmtst_tbl_setup and is_pf_func_valid, CVSS 9.9 (Very Critical), remote privilege-management break; CVE-2026-72050 is a Critical resource-allocation bug in nix_setup_bpids.

Incident overview

Afternoon UTC, 15 Aug 2026: multiple Linux kernel CVE feeds simultaneously disclosed two independent bugs in the Marvell OcteonTX NIC-family driver octeontx2-af. CVE-2026-72045 covers two mbox callback handlers in the driver, rvu_mbox_handler_lmtst_tbl_setup and is_pf_func_valid; csirts.com rates it Very Critical, CVSS 9.9. Same-day CVE-2026-72050 targets base_pcifunc/FUNC handling in nix_setup_bpids, rated Critical. No official PoC for either. SecLens ingested both around 2026-08-15 11:36 UTC.

Technical details

CVE-2026-72045: is_pf_func_valid in octeontx2-af validates that PF (Physical Function)/VF (Virtual Function) IDs from the RVU mailbox fall in range. rvu_mbox_handler_lmtst_tbl_setup configures LM (Limited Mem) table entries. Failed validation lets an attacker inject out-of-range PF/VF indexes, read or rewrite arbitrary PF resources, trigger OOB memory R/W, and pivot into the driver call chain. CWE: improper privilege management. CVSS:3.x vector AV:N/AC:L/PR:N/UI:N (S:U/C:H/I:H/A:H) — kernel-level network entry, no source-address restriction required.

CVE-2026-72050: nix_setup_bpids allocates RVU-internal BPID (Buffer Pool ID) resources. Parameters base_pcifunc/FUNC are passed to the underlying allocator without bounds checks, causing integer overflow or resource mismatch; subsequent NIX TX/RX queue config then diverges from expected state. CWE: resource-allocation defect. CVSS: Critical.

Impact

Affects mainline 6.6.147 / 6.12.100 / 6.18.41 / 7.1.4 and earlier. Servers, NFV accelerators, and DPU gateways using Marvell OcteonTX CN98XX NICs or BGX/RPM MAC blocks are in scope. Scoring bodies place CVE-2026-72045 above 99.99% of scored vulns worldwide; among the first Very Critical ratings of Aug 2026. Given recent io_uring, vsock, and nf_tables kernel bugs, octeontx2-af mbox paths sit on the default in-kernel network stack and can be triggered remotely without a local shell. Cloud operators and self-hosted IDC should patch first; do not rely on ASLR/KASLR.

Remediation

Emergency patch procedure and rollback

For 24/7 cloud gateways and telco NFV nodes, apply livepatch first (KernelCare / kpatch / Ubuntu Livepatch Service) to cover CVE-2026-72045 and CVE-2026-72050, then schedule a reboot onto mainline. If livepatch cannot cover mbox-driver internal data-structure changes, plan a 30–60 minute maintenance window and a standard rollback: (1) Debian/Ubuntu: apt-mark hold linux-image-$(uname -r) to keep the old package; (2) keep at least two kernel entries in the GRUB menu; (3) before rollback, record bond/vlan/macvlan state with ip addr show and ethtool -S; compare after. For OcteonTX DPU accelerator cards (LiquidIO, CX series), confirm firmware version vs mainline driver ABI so the patched kernel still recognizes existing firmware.

Related vulnerability trend

Linux kernel 2026 already has multiple CVSS 9.0+ bugs on mbox/netfilter/io_uring/nf_tables paths: io_uring CVE-2026-14812 (local priv esc), vsock CVE-2026-13019 (info leak), netfilter CVE-2026-17670 (remote priv esc). Common pattern: default-loaded drivers/subsystems, trigger path in the network stack. Linux 6.6 LTS and 6.12 LTS security-advisory cadence is up vs 2024–2025. Tighten kernel patch cycles from monthly to weekly; use livepatch for in-kernel criticals; save full kernel upgrades for nodes with a maintenance window.

References