CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved:

vdpa/mlx5: Fix buffer length in createdirectkeys()

We have seen in our CI the following KASAN message:

BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 [mlx5core]

Read of size 272 at addr 0000000176795020 by task qemu-system-s39/82764

[...]

[<000011388ab3a7a0>] cmdexec+0x550/0xca0 [mlx5core]

[<000011388ab3b61c>] mlx5cmdexeccb+0x25c/0x4f0 [mlx5core]

[<000011388b21e82e>] mlx5vdpaexecasynccmds+0x22e/0x5e0 [mlx5_vdpa]

[<000011388b21fd44>] createdirectkeys+0x954/0xef0 [mlx5_vdpa]

[...]

The buggy address is located 4128 bytes inside of

allocated 4384-byte region [0000000176794000, 0000000176795120)

So in essence we read 16 bytes beyond 4384-byte allocation.

createdirectkeys calculates the pointer and length for in and out

buffers.

The size calculation for in includes the entire structure

size (out + in + mtt[]) but the pointer passed to cmd_exec points only

to the 'in' field, skipping the 'out' field.

This causes mlx5copyto_msg() to read beyond the allocated buffer

by sizeof(out) bytes when copying command data.

Properly calculate the input size to match the pointer and allocation size.