CVE-2026-74712
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN mes…
Published Aug 22, 2026 · updated Oct 14, 2026
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [ ] cmd_exec+0x550/0xca0 [mlx5_core] [ ] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [ ] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [ ] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120) So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the 'in' field, skipping the 'out' field. This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data. Properly calculate the input size to match the pointer and allocation size.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 22, 2026 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [ ] cmd_exec+0x550/0xca0 [mlx5_core] [ ] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]
Oct 14, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [ ] cmd_exec+0x550/0xca0 [mlx5_core] [ ] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]
Sources
- CVE.orgVulnerability recordCVE-2026-74712
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-74712
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-74712
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795
nvd.nist.gov