CVE-2026-72312

A flaw was found in the Linux kernel's octeontx2-af driver. A Virtual Function (VF), which is a virtualized network interface, can inadvertently disable the promiscuous and all-multicast (all_multi) modes of the Physical Function (PF) network interface. This occurs because the underlying application programming interfaces (APIs) that control these modes operate globally on the PF, even when a request originates from a VF. An attacker with control over a VF could potentially disrupt network traffic monitoring or multicast communication on the PF, leading to a denial of service or information disclosure.

Red Hat rates this vulnerability as Moderate because exploitation requires local access to a Virtual Function on systems equipped with specialized Marvell OcteonTX2 hardware. While an entity controlling a delegated virtual interface can inadvertently or maliciously clear physical function packet reception rules and disrupt multicast or promiscuous traffic monitoring, it cannot compromise host memory or gain administrative control. Systems lacking this hardware accelerator or deployments that do not assign virtualized interfaces to untrusted environments are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.