Executive brief
A vulnerability was identified in the Linux kernel's Mellanox network driver that could cause a system crash. The issue occurs when the system handles specific network configuration requests for virtual network interfaces, leading to memory corruption. This could allow a local user with sufficient privileges to disrupt network services or cause a complete system outage.
Technical details
A slab-out-of-bounds vulnerability exists in the mlx5_query_nic_vport_mac_list function within the mlx5_core driver. The root cause is an incorrect buffer size calculation that relies on the Physical Function's (PF) capabilities rather than the specific Virtual Function's (VF) capabilities. When a VF is configured with a larger MAC list via devlink, the firmware response exceeds the allocated buffer, triggering a KASAN-detected slab-out-of-bounds error. An attacker with local access and the ability to trigger vport changes could exploit this to cause a denial-of-service (kernel panic). The fix involves querying the specific vport's HCA capabilities to ensure the buffer is sized correctly.
Affected products
- Linux Linux Kernel e16aea2744ab to 894e036a24a2
Timeline
- 2026-06-04: patched: Initial fix committed to the Linux kernel tree.
- 2026-06-25: disclosed: CVE-2026-53230 published.
References
- https://git.kernel.org/stable/c/0f807764bb122fd63aa45f4229cb1ef2679fbd40
- https://git.kernel.org/stable/c/2398e497389ed4be43f7cfbab499b49cec7dae1a
- https://git.kernel.org/stable/c/41781f2789309462520a93822e946521ed78f97f
- https://git.kernel.org/stable/c/537d87784e81c3d7037525b99416455cee088cdc
- https://git.kernel.org/stable/c/894e036a24a26a6dd7b17d8d3fb5c53ab48a6074