CVE-2026-72410

CVE-2026-72410 is not a memory safety bug. It is a state validation flaw in the Octeon TX2 NIX driver's devlink handler where a conditional expression fails to correctly determine whether Lookaside Filters have already been bound to physical or virtual functions. When this check evaluates incorrectly, an administrator with devlink write access can modify the maximum LF allocation ceiling after resources have already been assigned — violating the intended lifecycle sequence where resource ceilings must be set before allocation occurs. The practical impact is not a crash. The bug produces a false positive — it allows configuration that should be blocked. This creates an inconsistent mental model between the driver and the hardware: the driver believes fewer resources are committed than actually are, while the hardware continues operating based on its actual state. The result is silent resource misaccounting that surfaces during VF attachment attempts or when packet processing encounters the accounting discrepancy. Every packet flowing through that NIX instance is processed by a driver operating on incorrect resource state. The CVSS 7.8 rating misrepresents the actual risk because it treats this as a classical vulnerability with clear exploit steps. The real danger is that the driver permits writes that violate its own allocation model, and the hardware tolerates this silently. A PF can lower its max-LF count below the number of LFs already assigned to its VFs, creating a configuration the driver and hardware interpret differently. This does not require exploitation in the traditional sense — concurrent reconfiguration during normal operation can trigger the same misaccounting. Patch immediately. Review your devlink configurations for any Octeon TX2 devices and verify that max-LF parameters were not modified after LF assignment. Treat any such out-of-sequence configuration as potentially compromised. The vulnerability requires privileged devlink access, so audit who has that access and whether it is appropriately scoped. The low EPSS score likely reflects this being a logic bug rather than a classical exploit target, not genuine difficulty — the silent packet loss or traffic degradation this causes may already be happening in production without attribution.

Reviewed through automated stages and approved by a human before publication.