Linux Kernel EUVD-2026-39321

Requires a system using the mlx5_core driver with NVIDIA/Mellanox ConnectX hardware operating in SR-IOV / e-switch (switchdev) mode, AND a virtual function whose configured MAC-list maximum (log_max_current_uc_list / log_max_current_mc_list) has been set larger than the physical function's capability via devlink - this non-default, privileged configuration is the concrete prerequisite. The overflow then fires automatically when that VF's MAC address list changes, through the esw_vport_change_handler workqueue path. Limiting factors: it is not remotely reachable (AV:L), it depends on a privileged devlink configuration action and specific Mellanox/NVIDIA hardware, and the configuration is not present by default, so hosts without mlx5 SR-IOV or with VF MAC limits kept at/below the PF capability are not exposed.

Signals are mixed and lean toward moderate, config-gated risk rather than urgent mass exploitation. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C, base 8.7) reflects local access with low privileges and a scope change, but the description shows the real trigger is an out-of-bounds READ during automatic eswitch handling after an administrator has raised a VF's MAC-list maximum via devlink - a privileged, non-default configuration action. The most likely impact is information disclosure of adjacent kernel slab memory and/or a KASAN-detected crash/panic, not straightforward code execution; the supplied vector's C:H/I:L feels high for a 4-byte OOB read, so confidentiality impact may be overstated relative to the description. EPSS is low (0.18%, 7th percentile), there is no CISA KEV listing and no public exploit identified, consistent with a hardware- and configuration-specific kernel hardening fix. Net: a legitimate memory-safety defect worth patching on affected mlx5/SR-IOV hosts, but not a drop-everything internet-facing emergency. Conflict to verify with vendor: CVSS marks AV:L/PR:L while exploitation realistically depends on privileged devlink configuration of a VF - verify intended privilege level.

On a host with an mlx5 NIC in SR-IOV mode, a privileged operator (or compromised management plane) raises a virtual function's MAC-list maximum via devlink above the PF's capability; when that VF's address list subsequently changes, the kernel's eswitch worker queries the vport and reads past the undersized slab buffer, leaking adjacent kernel memory or panicking the host. No public exploit code is identified at time of analysis, and the local attack vector plus dependency on privileged devlink configuration make opportunistic exploitation unlikely.