Linux Kernel EUVD-2026-55394

Exploitation requires: (1) local access with CAP_NET_ADMIN privilege (or equivalent - PR:L in CVSS), (2) a Mellanox/NVIDIA ConnectX network adapter using the mlx5 driver, and (3) the adapter must advertise the mcia_32dwords capability, which is a hardware-level feature present in newer ConnectX generations. The trigger is an ethtool EEPROM query (e.g., ethtool --module-info or --eeprom-dump targeting the NIC). Exploitation is NOT possible remotely - the attack vector is strictly local (AV:L). On FORTIFY_SOURCE-enabled kernels (virtually all distribution kernels), the result is a guaranteed kernel panic rather than exploitable memory corruption, limiting the real-world impact to denial of service. Non-default conditions: requires physical/logical local access, specific NIC hardware with mcia_32dwords support, and mlx5 driver loaded.

Real-world risk is moderate-to-low despite the 7.1 CVSS score. The CVSS vector (AV:L/AC:L/PR:L) correctly reflects that an attacker must have local access and low-privilege credentials - this is not remotely exploitable. The EPSS score of 0.18% at the 8th percentile confirms the security community assigns minimal near-term exploitation probability, consistent with the absence of public exploit code or KEV listing. The primary realistic impact is kernel panic (denial of service) triggered by issuing an ethtool EEPROM query on a vulnerable adapter; the confidentiality impact (C:H) represents potential out-of-bounds kernel memory disclosure, though exploiting this for meaningful data exfiltration would require additional primitives. The vulnerability is reliably triggered on FORTIFY_SOURCE-enabled kernels (most distro kernels), making the DoS vector easily exercised by any local user with CAP_NET_ADMIN. For environments running Mellanox mlx5 NICs with the mcia_32dwords capability (common in high-speed data center deployments), this warrants patching during the next maintenance window rather than emergency response.

A low-privileged local user or container with CAP_NET_ADMIN issues an ethtool EEPROM page read command against a network interface backed by a Mellanox ConnectX adapter that advertises the mcia_32dwords capability. The mlx5 driver calls mlx5_query_mcia(), which calculates a read size of 128 bytes via mlx5_mcia_max_bytes() but memcpy()s into a struct sized for only 48 bytes, triggering either a FORTIFY_SOURCE kernel panic (DoS) or, on kernels without FORTIFY_SOURCE, silent out-of-bounds kernel memory access. No public exploit code exists at time of analysis, but the reproducibility is confirmed by the call trace in the CVE description itself.