CVE-2026-68293

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5: Fix MCIA register buffer overflow on 32 dword reads<br /> <br /> The MCIA register can return up to 32 dwords (128 bytes) when the device<br /> advertises the mcia_32dwords capability, but struct<br /> mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just<br /> 12 dwords (48 bytes) of data.<br /> <br /> mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then<br /> memcpy()s that many bytes out of the register, potentially reading past<br /> the end of the &amp;#39;out&amp;#39; buffer. On kernels built with FORTIFY_SOURCE this<br /> is caught as a buffer overflow while reading the module EEPROM via<br /> ethtool:<br /> <br /> detected buffer overflow in memcpy<br /> kernel BUG at lib/string_helpers.c:1048!<br /> RIP: 0010:fortify_panic+0x13/0x20<br /> Call Trace:<br /> mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]<br /> mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]<br /> mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]<br /> eeprom_prepare_data+0xf3/0x170<br /> ethnl_default_doit+0xf1/0x3b0<br /> <br /> Extend the mcia_reg layout to 32 dwords.