CVE-2026-74712
Received Received - Intake

Buffer Overflow in Mellanox vDPA mlx5 Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120) So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the 'in' field, skipping the 'out' field. This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data. Properly calculate the input size to match the pointer and allocation size.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74712
EUVD
EUVD-2026-64399

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mlx5 mlx5_core *
mlx5 mlx5_vdpa *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's vdpa/mlx5 driver. It occurs when creating direct keys in the mlx5_vdpa module. The issue involves incorrect calculation of input buffer size, causing the system to read 16 bytes beyond an allocated 4384-byte memory region. This leads to a slab-out-of-bounds error detected by KASAN.

Detection Guidance

This vulnerability is specific to the Linux kernel's vdpa/mlx5 driver and manifests as a slab-out-of-bounds read. Detection requires checking kernel logs for KASAN messages indicating buffer overflows in mlx5_core or mlx5_vdpa modules. Monitor system logs for errors related to cmd_exec or create_direct_keys functions.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It may lead to memory corruption, allowing attackers to execute arbitrary code or gain unauthorized access to the system. Systems using affected mlx5_core and mlx5_vdpa drivers are at risk.

Mitigation Strategies

Apply the kernel patch that fixes the buffer length calculation in create_direct_keys(). Update to a patched version of the Linux kernel. If immediate patching is not possible, disable the mlx5_vdpa module if not in use to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart