Skip to main content

Linux Kernel CVE-2026-68293

| EUVDEUVD-2026-55394 HIGH
2026-08-10 Linux GHSA-7555-mcj4-25r2
Buffer Overflow Linux
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local access with low privileges (CAP_NET_ADMIN) required to invoke ethtool; no integrity impact; high confidentiality and availability from OOB read and kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:39 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.1 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.1
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just 12 dwords (48 bytes) of data.

mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then memcpy()s that many bytes out of the register, potentially reading past the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this is caught as a buffer overflow while reading the module EEPROM via ethtool:

detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1048! RIP: 0010:fortify_panic+0x13/0x20 Call Trace: mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core] mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core] mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core] eeprom_prepare_data+0xf3/0x170 ethnl_default_doit+0xf1/0x3b0

Extend the mcia_reg layout to 32 dwords.

AnalysisAI

Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.

Technical ContextAI

The mlx5 driver (net/mlx5) supports Mellanox/NVIDIA ConnectX-series high-speed NICs, which are pervasive in cloud and enterprise data center environments. The MCIA (Module Control Interface Access) register is used to read transceiver/optical module EEPROM data via the ethtool interface. The affected code path is mlx5_query_mcia() → mlx5_query_module_eeprom_by_page() → mlx5e_get_module_eeprom_by_page() → eeprom_prepare_data(). When a device advertises the mcia_32dwords capability, mlx5_mcia_max_bytes() correctly returns 128 bytes; however, the 'out' buffer is backed by struct mlx5_ifc_mcia_reg_bits which only defines fields dword_0 through dword_11 (48 bytes). The subsequent memcpy of up to 128 bytes into this undersized structure constitutes a classic stack/heap buffer overflow. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* with the vulnerability introduced at commit 271907ee2f29cd1078fd219f0778fd824fb1971c (Linux 5.18). The CWE is not formally assigned, but the root cause class is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) / CWE-131 (Incorrect Calculation of Buffer Size).

RemediationAI

The primary fix is to upgrade to a patched kernel version: 6.12.101, 6.18.42, 7.1.6, or any release based on 7.2-rc5 or later. The upstream fix extends mlx5_ifc_mcia_reg_bits to 32 dwords to match the maximum hardware-advertised size. Stable-branch commits are available at https://git.kernel.org/stable/c/5be4eebd5a3a198dab0adcd550e1cadca79bdfed, https://git.kernel.org/stable/c/87b39a8c875ca744b7de69af0a8ef8874cffccf1, https://git.kernel.org/stable/c/88b2a16ddac3357e3f1d528e758b51e2c945d546, and https://git.kernel.org/stable/c/11c057d23465c7a5817a7284c896d19d54c0b616. As a compensating control prior to patching, restrict CAP_NET_ADMIN to trusted administrators only, which prevents unprivileged local users from invoking ethtool EEPROM queries; note this does not eliminate risk for privileged insiders or compromised admin accounts. Alternatively, blocking ethtool module-eeprom subcommand access via user namespaces or seccomp policy in container environments limits the attack surface. FORTIFY_SOURCE (enabled by default in most distribution kernels) converts the overflow into a kernel BUG/panic rather than silent memory corruption, which limits exploitability for information disclosure but confirms the DoS vector.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68293 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy