{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72329","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.919Z","datePublished":"2026-08-15T05:55:39.931Z","dateUpdated":"2026-08-17T05:42:51.194Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:42:51.194Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/liquidio: drop cached VF pci_dev LUT\n\nThe PF SR-IOV enable path caches VF pci_dev pointers in\ndpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those\nentries do not own a reference, because the iterator drops the previous\ndevice reference on each step. The cached pointer is then dereferenced\nlater when handling OCTEON_VF_FLR_REQUEST.\n\nReplace the cached VF mapping with runtime lookup on the mailbox DPI\nring: derive the VF index from q_no, resolve the VF via exported PCI\nIOV helpers, validate it with the PF pointer and VF ID, then issue\npcie_flr() and drop the reference with pci_dev_put(). Remove the\nunused VF lookup table initialization and cleanup."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in the Cavium LiquidIO CN23XX PF driver handling OCTEON_VF_FLR_REQUEST over the PCIe SR-IOV hardware mailbox, not via network packets; exploitation requires code running against an assigned VF (e.g., a cloud VM with SR-IOV passthrough).\nAC:L - VF pci_dev pointers in dpiring_to_vfpcidev_lut[] are stale immediately after SR-IOV enable because pci_get_device() drops references during iteration; an attacker controlling VF driver teardown can reliably send OCTEON_VF_FLR_REQUEST and repeat FLR attempts to influence heap reuse.\nPR:N - In the highest-impact deployment (multi-tenant cloud with VF passthrough), a tenant needs no host administrator privileges—only control of the assigned VF from within their VM—to trigger PF mailbox processing and pcie_flr() on the dangling pci_dev.\nUI:N - No victim interaction is required; triggering VF driver removal or module unload during octeon_destroy_resources() automatically sends the FLR mailbox request to the PF without any user action on the host.\nS:C - The vulnerable PF driver executes in the host kernel but is triggered from an isolated VF guest/tenant via the SR-IOV mailbox, crossing the VM/tenant security boundary into host kernel context.\nC:H - This is a use-after-free of struct pci_dev; pcie_flr() and pci_dev_reset_iommu_prepare() dereference freed pci_dev fields, enabling arbitrary kernel memory disclosure if the attacker reclaims the object via heap spraying.\nI:H - UAF of pci_dev causes pcie_flr() to issue PCI Express FLR config writes and IOMMU blocking on attacker-influenced memory, providing memory corruption primitives that can be leveraged for arbitrary kernel write or code execution.\nA:H - Dereferencing a stale pci_dev in pcie_flr() can oops or panic the host kernel, and issuing FLR/IOMMU operations against the wrong PCI function can disrupt host networking and device availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/cavium/liquidio/lio_main.c","drivers/net/ethernet/cavium/liquidio/octeon_device.h","drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c"],"versions":[{"version":"ca6139ffc67ee6ef0459f81e37894ed411083855","lessThan":"81acef3a247fd523513a2e9f71de1c167bc0f882","status":"affected","versionType":"git"},{"version":"ca6139ffc67ee6ef0459f81e37894ed411083855","lessThan":"5c0e3ba4f500fd4314ceb42f07f16bc445156431","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/cavium/liquidio/lio_main.c","drivers/net/ethernet/cavium/liquidio/octeon_device.h","drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c"],"versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/81acef3a247fd523513a2e9f71de1c167bc0f882"},{"url":"https://git.kernel.org/stable/c/5c0e3ba4f500fd4314ceb42f07f16bc445156431"}],"title":"net/liquidio: drop cached VF pci_dev LUT","x_generator":{"engine":"bippy-1.2.0"}}}}