PatchSiren cyber security CVE debrief

CVE-2026-72312 Linux CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:04.013Z and has not been modified since then. CVE-2026-72312 relates to a vulnerability in the Linux kernel, specifically in the octeontx2-af module. The vulnerability affects the Virtual Function (VF) bring-up process, which can inadvertently impact the Physical Function (PF) promiscuous state. This occurs because the mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. To address this issue, it is recommended to guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check. This ensures that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation. The vulnerability has been resolved in the Linux kernel, and users are advised to update to the latest kernel version or apply the provided patches. Additionally, compensating controls for promiscuous and allmulti MCAM rules should be implemented to mitigate potential risks. It is essential for Linux kernel operators and administrators to be aware of this vulnerability and verify their configurations. Security teams and vulnerability management teams should review the CVE-2026-72312 official CVE record and NVD detail for affected scope, severity, and vendor guidance.

Vendor: Linux
Product: Unknown
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-15
Original CVE updated: 2026-08-15
Advisory published: 2026-08-15
Advisory updated: 2026-08-15

Who should care

Linux kernel operators and administrators should be aware of this vulnerability and verify their configurations with compensating controls for promiscuous and allmulti MCAM rules. Security teams and vulnerability management teams should review CVE-2026-72312 official CVE record and NVD detail for affected scope, severity, and vendor guidance. IT operations and network security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The Linux kernel vulnerability CVE-2026-72312 relates to octeontx2-af and VF bring-up affecting PF promiscuous state. Mbox handling of nix_set_rx_mode for a VF with promiscuous and all_multi flags set to false causes deletion of the PF's promiscuous and allmulti MCAM rules. Guard both rvu_npc_enable_allmulti_entry() and rvu_npc_enable_promisc_entry() disable paths with an is_vf() check so that a VF bringing up or tearing down its interface cannot inadvertently clear the PF's MCAM rules. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation.

Defensive priority

Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation.

Recommended defensive actions

Verify Linux kernel configurations for octeontx2-af
Monitor for potential MCAM rule manipulation
Implement compensating controls for promiscuous and allmulti MCAM rules
Review CVE-2026-72312 official CVE record and NVD detail
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a vulnerability in the Linux kernel related to octeontx2-af and VF bring-up affecting PF promiscuous state. Operators should verify Linux kernel configurations and monitor for potential MCAM rule manipulation with evidence from CVE-2026-72312 official CVE record and NVD detail. Linux kernel operators and administrators should be aware of this vulnerability and verify their configurations with compensating controls for promiscuous and allmulti MCAM rules.

Sources and references

Verified primary and authoritative sources

CVE-2026-72312 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-72312

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-72312 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72312

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/212c59e5e416859579272288fd325148fc316109

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/3cf83432e0561aef6d7ec2664909d12d0ff0ffc1

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/3de77d2f34c2bc2acaedabc2c5e0a561b85c283a

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/53e17d9ed779ad25870abb9c31bc294c71a2278c

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/daa2451640a3e0727fd598f5c2ccb8bb4d5a8b9c

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/fabb881df322da25442f98d23f5fa371e3c78ec4

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.