CVE-2026-72329

CVE CVE-2026-72329EUVD EUVD-2026-59228Published 2026-08-15T05:55:39.000ZLast changed 2026-08-17T05:42:51.000ZCVSS 9.3

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci_dev LUT The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST. Replace the cached VF mapping with runtime lookup on the mailbox DPI ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux ca6139ffc67ee6ef0459f81e37894ed411083855 <81acef3a247fd523513a2e9f71de1c167bc0f882; ca6139ffc67ee6ef0459f81e37894ed411083855 <5c0e3ba4f500fd4314ceb42f07f16bc445156431; patch: 7.1.5; patch: 7.2; 4.10; patch: 0

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.