CVE-2026-74712 - vdpa/mlx5: Fix buffer length in create_direct_keys()
Brief
CVE ID : CVE-2026-74712
Published : Aug. 22, 2026, 4:16 p. m.
- 4 hours, 54 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [... ] [ ] cmd_exec+0x550/0xca0 [mlx5_core] [ ] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [ ] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [ ] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...
] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120)
So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers.