CVE-2026-72045

A flaw was found in the Linux kernel component octeontx2-af. A local attacker with access to a Virtual Function (VF) could exploit an unsanitized input in the rvu_mbox_handler_lmtst_tbl_setup() function. This vulnerability allows the VF to read the physical base address of another function's LMTLINE, which could lead to information disclosure and unauthorized access to sensitive system memory.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires local access within a virtual machine or container assigned a Marvell OCTEON TX2 or CN10K Virtual Function, limiting the attack surface to specialized hardware deployments with SR-IOV enabled. Standard Red Hat Enterprise Linux installations on generic enterprise hardware do not use this network driver and are unaffected in practice. Even where the hardware is present, unprivileged host users without access to a provisioned virtual function cannot trigger the condition. Consequently, risk is confined to multi-tenant environments delegating SR-IOV virtual functions to untrusted workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.