An isolation flaw in the Linux kernel octeontx2-af driver could allow an attacker with local access to influence hardware state, potentially compromising system security boundaries.

The vulnerability exists because PF and VF NIX LFs share a CGX LMAC and reuse hardware PKIND programming without proper isolation. A local attacker with low privileges can clobber this state, leading to a breakdown in hardware-enforced boundaries.

This flaw impacts the integrity of virtualized environments utilizing OcteonTX2 hardware. A successful exploit could lead to unauthorized access to data streams or cross-tenant interference, which is particularly concerning in multi-tenant cloud or hosting environments. The CVSS score of 8.8 highlights the severity of breaking these security boundaries.

Immediate Action: Update the Linux kernel to version 7.1.8 or later to ensure proper hardware state isolation.

Proactive Monitoring: Review system hardware logs and virtualization management logs for anomalies related to network interface controller (NIC) or VF configuration.

Compensating Controls: Implement strict hardware access controls and ensure that virtual machine environments are configured with proper isolation mechanisms that do not rely solely on the driver-level state.

Public Exploit Available: Unknown.

Organizations running infrastructure on OcteonTX2 hardware must prioritize this update to maintain hardware isolation integrity. While the attack vector is local, the potential for cross-tenant impact necessitates urgent attention for any provider hosting multiple customers on the same physical hardware.