Executive brief
The Linux kernel's RDMA/mlx5 driver contains a debugfs interface for congestion control parameters that can leak kernel memory. A debugfs operation formats an unsigned 32-bit value as a signed decimal, causing buffer overflow when the value exceeds 2 billion. An attacker with local debugfs access can read one byte of kernel stack memory beyond the buffer boundary.
Technical details
The vulnerability is a stack out-of-bounds read in the get_param() function within drivers/infiniband/hw/mlx5/cong.c. The function reads a u32 congestion parameter and formats it using snprintf() with the "%d" (signed) format specifier into an 11-byte stack buffer. When the u32 value has bit 31 set (e.g., 0x80000000), it renders as "-2147483648\n" (12 bytes), exceeding the buffer size. While snprintf() stores only 11 bytes, it returns 12, causing simple_read_from_buffer() to read one byte past the buffer boundary. The fix changes the buffer to 12 bytes, uses scnprintf() instead of snprintf(), and formats with "%u" to match the unsigned type. Exploitation requires local access to the debugfs interface.
Affected products
- Linux Linux kernel multiple versions (patched in stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-07-26: patched