The vulnerability arises from an unsanitized index used in the rvu_mbox_handler_lmtst_tbl_setup() routine. A virtual function (VF) can supply a base_pcifunc value that references another function’s LMTLINE base address, causing the driver to copy that address into the VF’s own mapping table. This allows the VF to read or duplicate configuration data belonging to a different function, potentially revealing sensitive hardware information or enabling unauthorized manipulation of device state.

The flaw affects Linux kernels that employ the OcteonTX2 AF CN10K device driver. No specific version ranges are listed, so any kernel containing the vulnerable implementation is potentially impacted. All Linux distributions running such kernels before receiving a patch are affected.

The CVSS score is not disclosed and EPSS is unavailable, so the exact severity remains unknown. The issue is not listed in the CISA KEV catalog. The attacker must control a virtual function and send a crafted mailbox request with an arbitrary base_pcifunc value. Successful exploitation could allow the VF to read or duplicate another function’s LMTLINE base address, undermining isolation between virtual machines and possibly facilitating further privilege escalation or tampering within the shared device context. Given the need for privileged VF access, the risk is primarily to virtualized environments where VFs can interact directly with hardware. The lack of EPSS data suggests that exploitation may not be widespread yet, but the potential impact on isolation remains significant.