CVE-2026-74712

A flaw was found in the Linux kernel's vdpa/mlx5 driver. This vulnerability occurs due to an incorrect calculation of buffer length within the create_direct_keys() function, causing the system to read beyond its allocated memory boundaries. A local attacker could exploit this memory corruption to trigger a system crash, leading to a denial of service (DoS), or potentially gain access to sensitive information.

A moderate-severity out-of-bounds read was found in the Linux kernel's vdpa/mlx5 driver. The create_direct_keys() function calculates the size of the command input buffer using the full structure size (out + in + mtt[]), but the pointer passed down the command path points only at the 'in' field. This causes mlx5_copy_to_msg() to read past the end of the allocated buffer by sizeof(out) bytes when copying command data to the device. A local attacker with access to a system configured with mlx5 vDPA hardware could use this flaw to crash the kernel and cause a denial of service; a small amount of adjacent kernel heap memory could also be exposed through the device command path. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 contain the vulnerable code and are affected. Because this is a moderate-severity local issue whose primary impact is denial of service, fixes for the affected streams are deferred to a later update cycle rather than shipped immediately; the residual risk is that a privileged local user on an affected system with mlx5 vDPA configured can trigger a kernel crash. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in those kernel streams. Red Hat's severity of Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) differs from the upstream CVE.org rating of 9.3 Critical: exploitation requires local access with privileges and an mlx5 vDPA hardware configuration, and the primary consequence is loss of availability rather than the broad confidentiality, integrity, and scope impact reflected in the upstream score.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.