{"apiVersion":"1.0","identifier":"CVE-2026-74712","description":"In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmd_exec+0x550/0xca0 [mlx5_core] [<000011388ab3b61c>] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core] [<000011388b21e82e>] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa] [<000011388b21fd44>] create_direct_keys+0x954/0xef0 [mlx5_vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120) So in essence we read 16 bytes beyond 4384-byte allocation. create_direct_keys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmd_exec points only to the -in- field, skipping the -out- field. This causes mlx5_copy_to_msg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data. Properly calculate the input size to match the pointer and allocation size.","publishedAt":"2026-08-22T16:16:45","lastModifiedAt":"2026-08-25T06:18:56","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74712","cvssScore":9.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00142,"riskScore":0.94,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74712","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74712","en":"https://www.redsauce.net/en/cves/CVE-2026-74712","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74712","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74712","de":"https://www.redsauce.net/de/cves/CVE-2026-74712","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74712","el":"https://www.redsauce.net/el/cves/CVE-2026-74712"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74712"}}