UBUNTU-CVE-2026-74712: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 [mlx5core] Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764 [...] [<000011388ab3a7a0>] cmdexec+0x550/0xca0 [mlx5core] [<000011388ab3b61c>] mlx5cmdexeccb+0x25c/0x4f0 [mlx5core] [<000011388b21e82e>] mlx5vdpaexecasynccmds+0x22e/0x5e0 [mlx5vdpa] [<000011388b21fd44>] createdirectkeys+0x954/0xef0 [mlx5vdpa] [...] The buggy address is located 4128 bytes inside of allocated 4384-byte region [0000000176794000, 0000000176795120) So in essence we read 16 bytes beyond 4384-byte allocation. createdirectkeys calculates the pointer and length for in and out buffers. The size calculation for in includes the entire structure size (out + in + mtt[]) but the pointer passed to cmdexec points only to the 'in' field, skipping the 'out' field. This causes mlx5copytomsg() to read beyond the allocated buffer by sizeof(out) bytes when copying command data. Properly calculate the input size to match the pointer and allocation size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The listed package variants are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What component and workload context are associated with the failure?
The fault is in the mlx5 vDPA path, specifically create_direct_keys(), with mlx5_core command execution involved. The reported KASAN trace was observed in a qemu-system task.
How can this issue appear during testing or diagnosis?
The supplied report shows KASAN detecting a slab-out-of-bounds read in mlx5_core's cmd_exec(). The read was 272 bytes and occurred 16 bytes past a 4384-byte allocation, with create_direct_keys() and mlx5_vdpa_exec_async_cmds() in the call trace.
What access characteristics are assigned by the provided severity vector?
The provided CVSS vector assigns local attack vector, low attack complexity, no privileges required, and no user interaction. It also assigns high confidentiality, integrity, and availability impacts, with scope changed.