Executive brief
The Linux kernel's mlx5 virtual DPA (data path accelerator) driver for Mellanox hardware contains a buffer length calculation error that allows reading beyond allocated memory. A local attacker could potentially trigger a kernel crash (denial of service) or leak sensitive kernel memory during virtualization operations.
Technical details
The vulnerability is a heap buffer over-read in the create_direct_keys() function within the mlx5 vdpa driver. The root cause is a miscalculation of the input buffer size: the code computes the size as struct_size(cmd_mem, mtt, mttcount), which includes the entire structure (out + in + mtt[]), but passes a pointer to only the 'in' field, causing mlx5_copy_to_msg() to read ~16 bytes beyond the allocated 4384-byte region. The issue is triggered during memory key creation in virtual DPA operations. The vulnerability requires local access to trigger (e.g., hypervisor context when managing virtual devices). A fix was merged upstream (commit 727e1f569855df83579edbd73dcb4a0723543a12) that adjusts the inlen calculation to subtract the offset of the 'in' field.
Affected products
- Linux Linux kernel Multiple versions; fixed in mainline and stable series
Timeline
- 2026-08-22: disclosed
- 2026-07-06: patched: Original upstream fix commit 727e1f569855df83579edbd73dcb4a0723543a12