CVE-2026-53230

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list<br /> <br /> mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using<br /> the PF&amp;#39;s log_max_current_uc/mc_list capabilities. When querying a VF<br /> vport with a larger configured max (via devlink), the firmware response<br /> can overflow this buffer:<br /> <br /> BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]<br /> Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385<br /> <br /> CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)<br /> Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x69/0xa0<br /> print_report+0x176/0x4e4<br /> kasan_report+0xc8/0x100<br /> mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]<br /> esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core]<br /> esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core]<br /> esw_vport_change_handler+0x6a/0x90 [mlx5_core]<br /> process_one_work+0x87f/0x15e0<br /> worker_thread+0x62b/0x1020<br /> kthread+0x375/0x490<br /> ret_from_fork+0x4dc/0x810<br /> ret_from_fork_asm+0x11/0x20<br /> <br /> <br /> Fix by querying the vport&amp;#39;s own HCA caps to size the buffer correctly.<br /> Refactor the function to allocate and return the MAC list internally,<br /> removing the caller&amp;#39;s dependency on knowing the correct max.