PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72312 Linux CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:04.013Z and has not been modified since then. CVE-2026-72312 relates to a vulnerability in the Linux kernel, specifically in the octeontx2-af module. The vulnerability affects the Virtual Function (VF) bring-up process, which can inadvertently impact the Physical Function (PF) promiscuous state. This occurs because the mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. To address this issue, it is recommended to guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check. This ensures that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation. The vulnerability has been resolved in the Linux kernel, and users are advised to update to the latest kernel version or apply the provided patches. Additionally, compensating controls for promiscuous and allmulti MCAM rules should be implemented to mitigate potential risks. It is essential for Linux kernel operators and administrators to be aware of this vulnerability and verify their configurations. Security teams and vulnerability management teams should review the CVE-2026-72312 official CVE record and NVD detail for affected scope, severity, and vendor guidance.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-08-15
Advisory published
2026-08-15
Advisory updated
2026-08-15

Who should care

Linux kernel operators and administrators should be aware of this vulnerability and verify their configurations with compensating controls for promiscuous and allmulti MCAM rules. Security teams and vulnerability management teams should review CVE-2026-72312 official CVE record and NVD detail for affected scope, severity, and vendor guidance. IT operations and network security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The Linux kernel vulnerability CVE-2026-72312 relates to octeontx2-af and VF bring-up affecting PF promiscuous state. Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation.

Defensive priority

Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation.

Recommended defensive actions

  • Verify Linux kernel configurations for octeontx2-af
  • Monitor for potential MCAM rule manipulation
  • Implement compensating controls for promiscuous and allmulti MCAM rules
  • Review CVE-2026-72312 official CVE record and NVD detail
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a vulnerability in the Linux kernel related to octeontx2-af and VF bring-up affecting PF promiscuous state. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation with evidence from CVE-2026-72312 official CVE record and NVD detail. Linux kernel operators and administrators should be aware of this vulnerability and verify their configurations with compensating controls for promiscuous and allmulti MCAM rules.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:04.013Z and has not been modified since then.