Linux Kernel CVE-2026-74712

Exploitation requires a host running the mlx5 vDPA driver (mlx5_vdpa) on NVIDIA/Mellanox ConnectX-class hardware with vDPA configured, and the ability to create/drive a vDPA device so that create_direct_keys() is invoked (in practice via vhost-vdpa/QEMU device setup, a privileged host operation). It is NOT remote or unauthenticated despite the PR:N in the published vector: the code path is a local kernel driver operation gated by device-management privileges. Limiting factors that reduce real-world risk: the specialized hardware requirement, the need for vDPA to be deployed and the driver loaded, the local access requirement, and the fact that the primitive is a bounded 16-byte read rather than a controllable write.

The signals conflict and warrant a downward reassessment from the headline score. The published CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.3) is characteristic of automated Linux kernel scoring and appears inflated: this is a bounded 16-byte OOB *read* (information/stability risk), not a write primitive, yet it is scored C:H/I:H/A:H with scope change. PR:N is also questionable because reaching create_direct_keys() requires the ability to create and drive an mlx5 vDPA device - a privileged host operation (typically root/CAP_NET_ADMIN via vhost-vdpa/QEMU), not unauthenticated access. Supporting signals agree it is not urgent for most fleets: EPSS is 0.21% (11th percentile), there is no KEV listing, and no public PoC. Realistic impact is a small adjacent-kernel-memory disclosure into a firmware command buffer or a KASAN-detected crash on hardened kernels. Bottom line: patch it in the normal stable-kernel cycle rather than treating the 9.3 as an emergency, but hosts that expose vDPA to semi-trusted VM tenants should prioritize it higher. Where CVSS (network/critical) and the description (local, config-specific driver path) diverge, trust the description - verify with the kernel stable commits before acting on the raw score.

A local user or a semi-trusted VM-management process with rights to provision mlx5 vDPA devices (e.g., via QEMU/vhost-vdpa) triggers create_direct_keys(), causing the driver to read 16 bytes of adjacent kernel slab memory into a firmware command message. Depending on layout, this yields a minor kernel-memory disclosure or a crash/instability; no public PoC exists beyond the CI KASAN report that surfaced the bug.