High 8.8Published Aug 15, 2026

CVE-2026-74527octeontx2-af: Block VFs from clobbering special CGX PKIND state

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates when the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 94d942c5fb970ac2166216838b278613decfa9a0 before a76243488740a07c81c9adf431685bb7f7c31d8c; from 94d942c5fb970ac2166216838b278613decfa9a0 before d3c6b0f48f126a36955b3fb4154a59d0b3621d97; 94d942c5fb970ac2166216838b278613decfa9a0 builds before 3bd438a58e910db5dc369aa25dfed1fc95f1b596	CNA record

References

https://git.kernel.org/stable/c/a76243488740a07c81c9adf431685bb7f7c31d8c
https://git.kernel.org/stable/c/d3c6b0f48f126a36955b3fb4154a59d0b3621d97
https://git.kernel.org/stable/c/3bd438a58e910db5dc369aa25dfed1fc95f1b596

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.