Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:57.983Z",
  "pubdate": "2026-08-15T13:17:57.983Z",
  "executiveSummary": "A state clobbering vulnerability exists in the Linux kernel within the octeontx2-af driver, specifically affecting the management of CGX PKIND configurations between Physical Functions (PFs) and Virtual Functions (VFs).\nThe vulnerability allows untrusted or unprivileged Virtual Functions to overwrite critical hardware PKIND programming and default TX parse configurations established by the Physical Function when HiGig2 or EDSA parsing is enabled on a shared CGX LMAC.\nThis improper state isolation impacts system integrity and hardware packet processing predictability across multi-tenant or virtualized environments sharing network resources.\nAn attacker with access to a compromised or malicious VF driver can leverage this flaw to disrupt network traffic, corrupt parsing states, or induce denial-of-service conditions affecting the host or co-resident virtual machines.\nExploitation requires local execution context within a guest virtual machine or container assigned a VF that shares a CGX LMAC with a PF utilizing specialized encapsulation protocols.",
  "technicalDetails": "The vulnerability resides in the resource sharing mechanism between PF and VF NIX LFs that share a common CGX LMAC within the octeontx2 architecture, specifically in how hardware PKIND programming and NIX_AF_LFX_TX_PARSE_CFG registers are managed.\nWhen encapsulation protocols such as HiGig2 or EDSA are active, the LMAC RX PKIND and default TX parse configurations are meticulously established by the PF during initialization. Prior to the fix, a VF NIX LF allocation routine would unconditionally execute cgx_set_pkind(), rvu_npc_set_pkind(), and update NIX_AF_LFX_TX_PARSE_CFG without validating whether the underlying hardware was already utilizing specialized parsing states like NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.\nThe root cause is a lack of authorization and state validation checks during VF initialization, permitting lower-privilege VF components to overwrite global or PF-owned hardware parser configurations on shared resources.\nThe attack flow proceeds as follows: First, the administrator configures the PF to utilize HiGig2 or EDSA parsing on a specific CGX LMAC. Second, a malicious or compromised VF initializes or requests a NIX LF allocation. Third, the unvalidated VF initialization sequence issues hardware configuration commands that overwrite the existing PKIND and TX parse configurations. Finally, this clobbering corrupts packet parsing for the PF and other entities sharing the LMAC, leading to misrouted frames, dropped packets, or hardware-level faults.\nThe vulnerable components include the cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG update routines within the octeontx2-af driver framework.\nMitigation of this vector requires the integration of validation primitives, specifically cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted(), which enforce checks ensuring that VFs bypass PKIND and parse configuration updates when the LMAC operates under specialized encapsulation states."
}