EUVD-2026-64399
GHSA-8f7v-7fr8-r5c3
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Local vDPA device management requires privileges (PR:L); a bounded 16-byte OOB read gives limited kernel info disclosure (C:L) and possible crash (A:L), with no write/integrity impact and no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix buffer length in create_direct_keys()
We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120)
So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the 'in' field, skipping the 'out' field.
This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data.
Properly calculate the input size to match the pointer and allocation size.
AnalysisAI
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a host running the mlx5 vDPA driver (mlx5_vdpa) on NVIDIA/Mellanox ConnectX-class hardware with vDPA configured, and the ability to create/drive a vDPA device so that create_direct_keys() is invoked (in practice via vhost-vdpa/QEMU device setup, a privileged host operation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant a downward reassessment from the headline score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user or a semi-trusted VM-management process with rights to provision mlx5 vDPA devices (e.g., via QEMU/vhost-vdpa) triggers create_direct_keys(), causing the driver to read 16 bytes of adjacent kernel slab memory into a firmware command message. Depending on layout, this yields a minor kernel-memory disclosure or a crash/instability; no public PoC exists beyond the CI KASAN report that surfaced the bug. |
| Remediation | Vendor-released patch: upgrade to Linux stable 6.12.104, 6.18.45, 7.1.9, or 7.2 (or later in each series), which correct the input-size calculation in create_direct_keys() so it matches the 'in' pointer and allocation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running the Linux kernel with mlx5 vDPA driver enabled, prioritizing virtualization hosts and cloud infrastructure platforms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today