Answer in brief
CVE-2026-74712 records a Critical severity (CVSS 9.3) vulnerability in vdpa/mlx5: Fix buffer length in create_direct_keys(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0071b138d44af4296bf871e6624369ce697b4b15 <ec3bb289cf19d526224117d5d450a5fd9cbd5ab2 || >=0071b138d44af4296bf871e6624369ce697b4b15 <cde8931a25392670dd59a0acfcab87a830ab66c5 || >=0071b138d44af4296bf871e6624369ce697b4b15 <6c8a9f7bc00301e533a5366384f3070a8e7f8430 || >=0071b138d44af4296bf871e6624369ce697b4b15 <727e1f569855df83579edbd73dcb4a0723543a12 | ec3bb289cf19d526224117d5d450a5fd9cbd5ab2, cde8931a25392670dd59a0acfcab87a830ab66c5, 6c8a9f7bc00301e533a5366384f3070a8e7f8430, 727e1f569855df83579edbd73dcb4a0723543a12 |
| Linux/Linuxgeneric | 6.12 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120) So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the 'in' field, skipping the 'out' field. This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data. Properly calculate the input size to match the pointer and allocation size.
Quoted source text, attributed separately from HOL analysis.