CVE-2026-90416: RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs
getparam() reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf() stores only 11 bytes yet returns 12, so simplereadfrombuffer() treats 12 bytes as valid and reads one byte past lbuf[].
Size the buffer for the widest unsigned decimal, format with "%u" to match the u32, and use scnprintf() so the length passed to simplereadfrombuffer() reflects the bytes actually stored.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the out-of-bounds read?
Exposure requires the RDMA/mlx5 cc_params debugfs path to be used and a congestion parameter value with bit 31 set. A value such as 0x80000000 causes the signed decimal representation to exceed the 11-byte stack buffer.
What condition triggers the read past the stack buffer?
The issue is triggered when get_param() reads a u32 congestion parameter, formats it with signed "%d", and the resulting negative decimal value is 12 bytes including the newline. snprintf() stores fewer bytes than it reports, and simple_read_from_buffer() is then given the larger reported length.
How can I determine whether the fix is present?
The corrected code sizes the buffer for the widest unsigned decimal value, formats the u32 with "%u", and uses scnprintf() so the length passed to simple_read_from_buffer() matches the bytes stored. Code that retains an 11-byte buffer, signed "%d" formatting, and snprintf() has the vulnerable pattern.