GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68293 (GCVE-0-2026-68293)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:02
VLAI
Title
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just 12 dwords (48 bytes) of data. mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then memcpy()s that many bytes out of the register, potentially reading past the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this is caught as a buffer overflow while reading the module EEPROM via ethtool: detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1048! RIP: 0010:fortify_panic+0x13/0x20 Call Trace: mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core] mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core] mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core] eeprom_prepare_data+0xf3/0x170 ethnl_default_doit+0xf1/0x3b0 Extend the mcia_reg layout to 32 dwords.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 271907ee2f29cd1078fd219f0778fd824fb1971c , < 5be4eebd5a3a198dab0adcd550e1cadca79bdfed (git)
Affected: 271907ee2f29cd1078fd219f0778fd824fb1971c , < 87b39a8c875ca744b7de69af0a8ef8874cffccf1 (git)
Affected: 271907ee2f29cd1078fd219f0778fd824fb1971c , < 88b2a16ddac3357e3f1d528e758b51e2c945d546 (git)
Affected: 271907ee2f29cd1078fd219f0778fd824fb1971c , < 11c057d23465c7a5817a7284c896d19d54c0b616 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/port.c",
            "include/linux/mlx5/mlx5_ifc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5be4eebd5a3a198dab0adcd550e1cadca79bdfed",
              "status": "affected",
              "version": "271907ee2f29cd1078fd219f0778fd824fb1971c",
              "versionType": "git"
            },
            {
              "lessThan": "87b39a8c875ca744b7de69af0a8ef8874cffccf1",
              "status": "affected",
              "version": "271907ee2f29cd1078fd219f0778fd824fb1971c",
              "versionType": "git"
            },
            {
              "lessThan": "88b2a16ddac3357e3f1d528e758b51e2c945d546",
              "status": "affected",
              "version": "271907ee2f29cd1078fd219f0778fd824fb1971c",
              "versionType": "git"
            },
            {
              "lessThan": "11c057d23465c7a5817a7284c896d19d54c0b616",
              "status": "affected",
              "version": "271907ee2f29cd1078fd219f0778fd824fb1971c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/port.c",
            "include/linux/mlx5/mlx5_ifc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix MCIA register buffer overflow on 32 dword reads\n\nThe MCIA register can return up to 32 dwords (128 bytes) when the device\nadvertises the mcia_32dwords capability, but struct\nmlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just\n12 dwords (48 bytes) of data.\n\nmlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then\nmemcpy()s that many bytes out of the register, potentially reading past\nthe end of the \u0027out\u0027 buffer. On kernels built with FORTIFY_SOURCE this\nis caught as a buffer overflow while reading the module EEPROM via\nethtool:\n\n  detected buffer overflow in memcpy\n  kernel BUG at lib/string_helpers.c:1048!\n  RIP: 0010:fortify_panic+0x13/0x20\n  Call Trace:\n   mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]\n   mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]\n   mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]\n   eeprom_prepare_data+0xf3/0x170\n   ethnl_default_doit+0xf1/0x3b0\n\nExtend the mcia_reg layout to 32 dwords."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local ethtool interfaces on the mlx5 netdev \u2014 the ETHTOOL_MSG_MODULE_EEPROM_GET genetlink message or the ETHTOOL_GMODULEEEPROM ioctl on a socket. No remote peer or received packet can trigger it.\nAC:L - A single ethtool module-EEPROM read of 128 bytes deterministically triggers the over-read on any adapter whose firmware advertises mcia_32dwords, which is the normal case on modern ConnectX hardware with a transceiver installed. No race, no memory-layout grooming, fully repeatable.\nPR:L - Both entry points check ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-relative, so the root of an unprivileged user namespace owning a netns that holds an mlx5 VF/subfunction netdev (a standard SR-IOV container setup) can trigger it without any privilege in the initial namespace.\nUI:N - The attacker triggers the read entirely on their own by issuing an ethtool query; no action by another user or administrator is needed.\nS:U - The out-of-bounds read and its consequences are confined to the kernel of the same host; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - Up to 80 bytes of kernel stack adjacent to the 64-byte \u0027out\u0027 buffer are memcpy()\u0027d into the EEPROM data returned to userspace, disclosing saved registers, pointers and potentially return addresses or the stack canary \u2014 enough to defeat KASLR and stack protection and aid further exploitation.\nI:N - The defect is purely a read overflow; the destination buffer is sized from the caller\u0027s own request length, so no kernel memory is written out of bounds and no data is modified.\nA:H - On the widely enabled CONFIG_FORTIFY_SOURCE the copy hits fortify_panic(), producing a kernel BUG/oops in mlx5_query_mcia() while rtnl/netdev locks are held (per the reported trace), wedging networking and panicking outright with panic_on_oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:29.111Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5be4eebd5a3a198dab0adcd550e1cadca79bdfed"
        },
        {
          "url": "https://git.kernel.org/stable/c/87b39a8c875ca744b7de69af0a8ef8874cffccf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/88b2a16ddac3357e3f1d528e758b51e2c945d546"
        },
        {
          "url": "https://git.kernel.org/stable/c/11c057d23465c7a5817a7284c896d19d54c0b616"
        }
      ],
      "title": "net/mlx5: Fix MCIA register buffer overflow on 32 dword reads",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68293",
    "datePublished": "2026-08-10T12:02:26.414Z",
    "dateReserved": "2026-07-30T09:28:09.380Z",
    "dateUpdated": "2026-08-17T05:02:29.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68293",
      "date": "2026-09-11",
      "epss": "0.00138",
      "percentile": "0.03503"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68293\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:18.693\",\"lastModified\":\"2026-08-17T05:18:31.967\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Fix MCIA register buffer overflow on 32 dword reads\\n\\nThe MCIA register can return up to 32 dwords (128 bytes) when the device\\nadvertises the mcia_32dwords capability, but struct\\nmlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just\\n12 dwords (48 bytes) of data.\\n\\nmlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then\\nmemcpy()s that many bytes out of the register, potentially reading past\\nthe end of the \u0027out\u0027 buffer. On kernels built with FORTIFY_SOURCE this\\nis caught as a buffer overflow while reading the module EEPROM via\\nethtool:\\n\\n  detected buffer overflow in memcpy\\n  kernel BUG at lib/string_helpers.c:1048!\\n  RIP: 0010:fortify_panic+0x13/0x20\\n  Call Trace:\\n   mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]\\n   mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]\\n   mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]\\n   eeprom_prepare_data+0xf3/0x170\\n   ethnl_default_doit+0xf1/0x3b0\\n\\nExtend the mcia_reg layout to 32 dwords.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/port.c\",\"include/linux/mlx5/mlx5_ifc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"271907ee2f29cd1078fd219f0778fd824fb1971c\",\"lessThan\":\"5be4eebd5a3a198dab0adcd550e1cadca79bdfed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"271907ee2f29cd1078fd219f0778fd824fb1971c\",\"lessThan\":\"87b39a8c875ca744b7de69af0a8ef8874cffccf1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"271907ee2f29cd1078fd219f0778fd824fb1971c\",\"lessThan\":\"88b2a16ddac3357e3f1d528e758b51e2c945d546\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"271907ee2f29cd1078fd219f0778fd824fb1971c\",\"lessThan\":\"11c057d23465c7a5817a7284c896d19d54c0b616\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/port.c\",\"include/linux/mlx5/mlx5_ifc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11c057d23465c7a5817a7284c896d19d54c0b616\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5be4eebd5a3a198dab0adcd550e1cadca79bdfed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/87b39a8c875ca744b7de69af0a8ef8874cffccf1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/88b2a16ddac3357e3f1d528e758b51e2c945d546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:14:26+00:00",
      "cve": "CVE-2026-68293",
      "id": "CVE-2026-68293",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68293.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:05:16Z",
      "cve": "CVE-2026-68293",
      "id": "CVE-2026-68293",
      "initial_release_date": "2026-08-14T17:14:36Z",
      "product_status:first_fixed": "83",
      "product_status:known_affected": "164",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "11",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68293",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68293.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.