CVE-2026-74712

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vdpa/mlx5: Fix buffer length in create_direct_keys()<br /> <br /> We have seen in our CI the following KASAN message:<br /> BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core]<br /> Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764<br /> [...]<br /> [] cmd_exec+0x550/0xca0 [mlx5_core]<br /> [] mlx5_cmd_exec_cb+0x25c/0x4f0 [mlx5_core]<br /> [] mlx5_vdpa_exec_async_cmds+0x22e/0x5e0 [mlx5_vdpa]<br /> [] create_direct_keys+0x954/0xef0 [mlx5_vdpa]<br /> [...]<br /> The buggy address is located 4128 bytes inside of<br /> allocated 4384-byte region [0000000176794000, 0000000176795120)<br /> <br /> So in essence we read 16 bytes beyond 4384-byte allocation.<br /> create_direct_keys calculates the pointer and length for in and out<br /> buffers.<br /> The size calculation for in includes the entire structure<br /> size (out + in + mtt[]) but the pointer passed to cmd_exec points only<br /> to the &amp;#39;in&amp;#39; field, skipping the &amp;#39;out&amp;#39; field.<br /> <br /> This causes mlx5_copy_to_msg() to read beyond the allocated buffer<br /> by sizeof(out) bytes when copying command data.<br /> <br /> Properly calculate the input size to match the pointer and allocation size.