CVE-2026-74712

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds read occurs in the create direct keys() function. The issue arises because the size calculation for the input buffer incorrectly includes the entire structure size (comprising the out, in, and mtt[] fields), while the pointer passed to the cmd exec() function points only to the in field. This discrepancy causes the mlx5 copy to msg() function to read beyond the allocated buffer by the size of the out field when copying command data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.