CVE-2026-68293

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

The MCIA register can return up to 32 dwords (128 bytes) when the device

advertises the mcia_32dwords capability, but struct

mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just

12 dwords (48 bytes) of data.

mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then

memcpy()s that many bytes out of the register, potentially reading past

the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this

is caught as a buffer overflow while reading the module EEPROM via

ethtool:

detected buffer overflow in memcpy

kernel BUG at lib/string_helpers.c:1048!

RIP: 0010:fortify_panic+0x13/0x20

Call Trace:

mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]

mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]

mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]

eeprom_prepare_data+0xf3/0x170

ethnl_default_d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References