Cloudanix VulnDB

CVE-2026-68293

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in certain network card drivers can crash the entire computer when a standard diagnostic command is run to check hardware details.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow in mlx5_query_mcia when the MCIA register returns up to 32 dwords but the struct only allocates space for 12, allowing memcpy to read past the end of the output buffer during module EEPROM queries via ethtool on FORTIFY_SOURCE kernels.

Why it matters to the business

Kernel panic and system crash on affected Mellanox Ethernet devices when standard network diagnostic tools query module information, leading to unplanned downtime and loss of connectivity.

How an attack unfolds

An attacker with local shell access on a system using mlx5-based NICs invokes ethtool to read module EEPROM data, which reaches mlx5_query_module_eeprom_by_page and triggers the oversized memcpy in mlx5_query_mcia, resulting in a detected buffer overflow panic.

How to fix it

Apply the upstream kernel patch that extends struct mlx5_ifc_mcia_reg_bits to 32 dwords; rebuild and deploy the updated kernel or install the vendor-provided fixed package for the distribution in use.

How to confirm the fix worked

Confirm the mcia_reg definition now contains dword_0 through dword_31, then re-run ethtool module EEPROM queries without triggering fortify_panic; verify the mlx5_core module version matches the patched release.

Typical attack path

  1. Obtain local unprivileged shell on affected Linux host
  2. Execute ethtool -m or equivalent EEPROM query command
  3. Kernel calls mlx5e_get_module_eeprom_by_page
  4. mlx5_query_mcia performs oversized read into undersized struct
  5. FORTIFY_SOURCE triggers fortify_panic and kernel BUG

How to detect it

Search kernel logs for 'detected buffer overflow in memcpy' and 'fortify_panic' originating from mlx5_query_mcia or mlx5_query_module_eeprom_by_page; correlate with ethtool process execution in audit logs.

  • fortify_panic+0x13/0x20
  • mlx5_query_mcia.isra.0
  • detected buffer overflow in memcpy

What your security team should do

  • Prioritize kernel update on all systems exposing mlx5 NICs to ethtool users
  • Restrict ethtool usage to administrative accounts via sudoers or capabilities until patched
  • Monitor for fortify_panic events in kernel logs as an immediate detection signal

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just 12 dwords (48 bytes) of data. mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then memcpy()s that many bytes out of the register, potentially reading past the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this is caught as a buffer overflow while reading the module EEPROM via ethtool: detected buffer overflow in memcpy kernel BUG at lib/string_helpers.c:1048! RIP: 0010:fortify_panic+0x13/0x20 Call Trace: mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core] mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core] mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core] eeprom_prepare_data+0xf3/0x170 ethnl_default_doit+0xf1/0x3b0 Extend the mcia_reg layout to 32 dwords.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities