CVE-2026-90416

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs

get_param() reads a congestion parameter as a u32 but formats it with the

signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as

0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf()

stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12

bytes as valid and reads one byte past lbuf[].

Size the buffer for the widest unsigned decimal, format with "%u" to match

the u32, and use scnprintf() so the length passed to

simple_read_from_buffer() reflects the bytes actually stored.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References