Junglewise Threat Intelligence

CVE-2026-74712: Linux kernel vdpa/mlx5 buffer overflow in create_direct_keys

CVE-2026-74712 · Severity: critical · CVSS 9.3 · Published 2026-08-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's mlx5 virtual DPA (data path accelerator) driver for Mellanox hardware contains a buffer length calculation error that allows reading beyond allocated memory. A local attacker could potentially trigger a kernel crash (denial of service) or leak sensitive kernel memory during virtualization operations.

Technical details

The vulnerability is a heap buffer over-read in the create_direct_keys() function within the mlx5 vdpa driver. The root cause is a miscalculation of the input buffer size: the code computes the size as struct_size(cmd_mem, mtt, mttcount), which includes the entire structure (out + in + mtt[]), but passes a pointer to only the 'in' field, causing mlx5_copy_to_msg() to read ~16 bytes beyond the allocated 4384-byte region. The issue is triggered during memory key creation in virtual DPA operations. The vulnerability requires local access to trigger (e.g., hypervisor context when managing virtual devices). A fix was merged upstream (commit 727e1f569855df83579edbd73dcb4a0723543a12) that adjusts the inlen calculation to subtract the offset of the 'in' field.

Affected products

  • Linux Linux kernel Multiple versions; fixed in mainline and stable series

Timeline

  • 2026-08-22: disclosed
  • 2026-07-06: patched: Original upstream fix commit 727e1f569855df83579edbd73dcb4a0723543a12

References

Related threats