Skip to main content

Linux Kernel EUVDEUVD-2026-39321

| CVE-2026-53230 HIGH
Out-of-bounds Read (CWE-125)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-pw9r-h2m6-6vvg
Buffer Overflow Information Disclosure Linux Red Hat Suse
8.7
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.7 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H
vuln.today AI
5.1 MEDIUM

Trigger requires privileged devlink configuration of a VF MAC-list max (PR:H) on local mlx5 hardware (AV:L); impact is a small OOB read causing potential info leak (C:L) and likely panic (A:H), no integrity change.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:39 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.7 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer:

BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385

CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core] Call Trace: <TASK> dump_stack_lvl+0x69/0xa0 print_report+0x176/0x4e4 kasan_report+0xc8/0x100 mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core] esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core] esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core] esw_vport_change_handler+0x6a/0x90 [mlx5_core] process_one_work+0x87f/0x15e0 worker_thread+0x62b/0x1020 kthread+0x375/0x490 ret_from_fork+0x4dc/0x810 ret_from_fork_asm+0x11/0x20 </TASK>

Fix by querying the vport's own HCA caps to size the buffer correctly. Refactor the function to allocate and return the MAC list internally, removing the caller's dependency on knowing the correct max.

AnalysisAI

Out-of-bounds kernel memory read in the Linux mlx5_core driver's mlx5_query_nic_vport_mac_list() function allows a slab-out-of-bounds access when querying a VF vport whose configured MAC-list maximum exceeds the PF's log_max_current_uc/mc_list capability. The driver sizes its firmware command buffer using the PF capabilities rather than the vport's own HCA caps, so an oversized firmware response overflows the buffer during eswitch vport-change handling. This affects systems running NVIDIA/Mellanox ConnectX (mlx5) NICs in SR-IOV/switchdev mode; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile).

Technical ContextAI

The bug lives in the mlx5_core driver that operates NVIDIA/Mellanox ConnectX-series RDMA/Ethernet adapters, specifically in the e-switch (embedded switch / SR-IOV) MAC address management path. mlx5_query_nic_vport_mac_list() issues a QUERY_NIC_VPORT_CONTEXT firmware command and allocates a response buffer sized from the physical function's log_max_current_uc_list and log_max_current_mc_list capabilities. A virtual function's per-vport MAC-list maximum can be raised independently via devlink, so the firmware can return more entries than the PF-derived buffer can hold, and the parsing loop reads past the slab allocation (KASAN flags a 4-byte read past the end). This is a classic buffer-sizing/bounds error (CWE-125 Out-of-bounds Read / CWE-131 Incorrect Calculation of Buffer Size, though the feed lists CWE as N/A) reached from the kernel workqueue context esw_vport_change_handler -> esw_update_vport_addr_list. The fix queries the vport's own HCA capabilities to size the buffer correctly and refactors the function to allocate and return the MAC list internally.

RemediationAI

Vendor-released patch: update to a fixed Linux stable kernel - 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later) on the matching branch, drawing the corresponding stable commit from https://git.kernel.org/stable/c/ (e.g. 894e036a24a26a6dd7b17d8d3fb5c53ab48a6074). For distribution kernels, apply the vendor backport carrying these commits. If immediate patching is not possible, the practical compensating control is to avoid the triggering configuration: do not raise VF MAC-list maximums beyond the PF capability via devlink (keep VF unicast/multicast MAC-list limits at or below the PF's log_max_current_uc/mc_list), since the overflow only manifests when a VF's configured max exceeds the PF-derived buffer size; the trade-off is reduced per-VF MAC filtering capacity for tenants needing many addresses. Where feasible, restrict who can run privileged devlink/SR-IOV configuration (CAP_NET_ADMIN) on these hosts to limit who can reach the vulnerable path. There is no remote-network exposure to block, so firewall/port controls are not applicable.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39321 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy