Linux kernel mlx5_core port / transceiver module EEPROM (MCIA register): The MCIA register can return 32 dwords

Impact

The MCIA register can return 32 dwords when the device advertises the capability, but the kernel's structure defines only 12, so reading module EEPROM copies past the end of the buffer. In practice this panics the host when an operator or monitoring agent runs ethtool against an optical module - so routine transceiver telemetry becomes a way to take a node down, and any agent that polls optics fleet-wide becomes a fleet-wide outage trigger.

Who can reach it

Local, low-privileged in the sense that the read is triggered from ethtool module-EEPROM queries; the overflowing length comes from what the adapter firmware advertises.

What to do

Upgrade the host kernel to 7.2 or a stable backport (6.12.101, 6.18.42, 7.1.6). Rolling reboot. Interim: stop automated optics/EEPROM polling on affected kernels - a monitoring config change, no reboot.

References