Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command buffer

Impact

create_direct_keys() sizes the input length from the whole out+in+mtt structure but hands cmd_exec a pointer to the 'in' field only, so mlx5_copy_to_msg() reads sizeof(out) bytes beyond the allocation - CI caught a 272-byte read 16 bytes past a 4384-byte region. The stale heap bytes are copied into a ConnectX firmware command; on a KASAN or hardened kernel the same access is fatal to the host. This is the mlx5 vDPA path used to give VMs accelerated networking on ConnectX NICs, so it is exercised by ordinary guest lifecycle operations on the shared fabric NIC rather than by an unusual configuration. The record does not establish attacker-controlled content or escalation.

Who can reach it

Host-side path exercised when a guest's mlx5 vDPA device creates its memory-region keys - reached by starting or reconfiguring a VM on a ConnectX-backed vDPA interface. No credentials beyond the ability to boot such a VM; hosts not running mlx5_vdpa are unaffected.

What to do

Update to a stable kernel with the fix. mlx5_vdpa is in use while guests hold vDPA interfaces, so in practice this means draining the VMs off the node and rebooting rather than reloading the module under load. No vendor advisory beyond the kernel commits is present in the record.

References

Related entries

• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored
• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored
• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored
• Linux kernel BPF verifier: commuted pointer arithmetic loses pointer provenance stateCVE-2026-74720 · Linux kernel BPF verifier (adjust_ptr_min_max_vals, scalar += pointer)Unscored
• Linux kernel sched_ext: a failed sub-scheduler enable races root disable into a use-after-freeCVE-2026-74731 · Linux kernel sched_ext (scx_sub_disable teardown of never-linked sub-schedulers)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical