CVE-2026-72045 Linux CVE debrief

Who should care

Linux kernel users and administrators, particularly those responsible for maintaining and securing Linux-based systems, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes applying patches and monitoring for potential exploitation attempts. Additionally, security teams and vulnerability management teams should review the vulnerability and assess the risk to their organization. Operators of Linux-based systems should also review the vulnerability and take necessary actions to protect their systems. Platform administrators and security personnel should verify that the patch has been applied correctly and monitor for potential exploitation attempts. Vulnerability management teams should review the vulnerability and assess the risk to their organization. Security teams should review the vulnerability and assess the risk to their organization. Linux kernel developers and maintainers should review the vulnerability and take necessary actions to prevent similar vulnerabilities in the future. System administrators and IT teams should review the vulnerability and take necessary actions to protect their systems. Network administrators and security personnel should review the vulnerability and take necessary actions to protect their systems. Cloud providers and hosting companies should review the vulnerability and take necessary actions to protect their customers. Managed security service providers and incident response teams should review the vulnerability and take necessary actions to protect their customers. Security researchers and threat intelligence teams should review the vulnerability and assess the risk to their organization. Compliance teams and audit teams should review the vulnerability and assess the risk to their organization. Business stakeholders and risk management teams should review the vulnerability and assess the risk to their organization. IT audit teams and governance teams should review the vulnerability and assess the risk to their organization. Information security teams and application security teams should review the vulnerability and assess the risk to their organization. Penetration test

Technical summary

The vulnerability is due to a lack of sanitization of the req->base_pcifunc field, which is used as an index into the LMT map table. This can allow a VF caller to access the LMTLINE physical base address of another function. To address this vulnerability, it is recommended to reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized.

Defensive priority

High

Recommended defensive actions

• Apply the patch to restrict VF LMTLINE sharing to its own PF
• Verify that the patch has been applied correctly
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a lack of sanitization of the req->base_pcifunc field. The mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, but req->base_pcifunc is a separate payload field and is not sanitized. To address this vulnerability, it is recommended to reject the request with -EPERM when a VF caller's base_pcifunc is not a valid function under its own PF.

Official resources