CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11, leaving room for just 12 dwords (48 bytes) of data.
mlx5querymcia() clamps the read size to mlx5mciamaxbytes() and then memcpy()s that many bytes out of the register, potentially reading past the end of the 'out' buffer. On kernels built with FORTIFYSOURCE this is caught as a buffer overflow while reading the module EEPROM via ethtool:
detected buffer overflow in memcpy kernel BUG at lib/stringhelpers.c:1048! RIP: 0010:fortifypanic+0x13/0x20 Call Trace: mlx5querymcia.isra.0+0x200/0x210 [mlx5core] mlx5querymoduleeeprombypage+0x4a/0xa0 [mlx5core] mlx5egetmoduleeeprombypage+0xbb/0x120 [mlx5core] eeprompreparedata+0xf3/0x170 ethnldefaultdoit+0xf1/0x3b0
Extend the mciareg layout to 32 dwords.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68293?
CVE-2026-68293 has a risk rating of 37, indicating a moderate severity level.
How do I fix CVE-2026-68293?
To address CVE-2026-68293, ensure you update the Linux kernel to a version that includes the fix for this buffer overflow vulnerability.
What systems are affected by CVE-2026-68293?
CVE-2026-68293 affects the Linux kernel due to its handling of the MCIA register under specific conditions.
What type of vulnerability is CVE-2026-68293?
CVE-2026-68293 is categorized as a buffer overflow vulnerability.
What can happen if CVE-2026-68293 is exploited?
If exploited, CVE-2026-68293 could potentially lead to memory corruption and enable attackers to execute arbitrary code.