The vulnerability in the Linux kernel's octeontx2-af cn10k driver stems from the function rvu_mbox_handler_lmtst_tbl_setup() using req->base_pcifunc as a direct index into the LMT map table without proper sanitization. While the mailbox dispatcher authenticates req->hdr.pcifunc from the IRQ source, the separate payload field req->base_pcifunc was not validated, allowing a virtual function (VF) to potentially access another function's LMTLINE physical base address. The fix involves rejecting requests with -EPERM when the VF caller's base_pcifunc is not valid under its own physical function (PF), using is_pf_func_valid() to ensure the index remains within the caller's PF slot block.

This vulnerability could allow a virtual function to access or share LMTLINE resources belonging to other physical functions, potentially leading to unauthorized data access or interference between functions. However, no known exploits in the wild have been reported. The impact is limited to the affected Linux kernel driver and its handling of VF LMTLINE sharing.

A fix has been implemented in the Linux kernel to restrict VF LMTLINE sharing to its own PF by validating the base_pcifunc field and rejecting unauthorized requests. Users should update to the fixed kernel version containing this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.