CVE-2026-53230: Linux mlx5 Driver Heap Buffer Overflow in MAC List Query

Technical summary

CVE-2026-53230 is a heap buffer overflow (CWE-125) in net/mlx5's mlx5_query_nic_vport_mac_list() function. The vulnerability occurs because the function sizes its firmware command buffer based on the PF's log_max_current_uc/mc_list capabilities without checking the target vport's individual HCA capabilities. When a VF is configured with a larger max MAC list count via devlink than the PF supports, the firmware response exceeds the allocated buffer, triggering a slab-out-of-bounds read detected by KASAN. The kernel stack trace shows the fault is triggered during ESW (eSwitch) vport change event handling. The resolution involves refactoring the function to query the vport's own HCA capabilities for proper buffer sizing and to allocate and manage the MAC list internally, decoupling callers from needing to know the correct maximum size.

Business impact

This vulnerability affects any system using Mellanox ConnectX network adapters in virtualized or multi-vport environments where devlink configuration is applied. The immediate risk is kernel panic (denial of service) when ESW vport events occur, potentially affecting all network traffic on the affected host. In multi-tenant cloud or containerized environments, a local unprivileged user able to trigger vport configuration changes could crash the kernel. The CVSS 8.7 HIGH score reflects the kernel compromise vector (affecting all users on the system) and confidentiality exposure, though direct code execution is not yet demonstrated. For enterprises managing large-scale virtualization with Mellanox hardware, this represents a stability and availability risk.

Affected systems

The Linux kernel is affected, with the vulnerability present in code that handles Mellanox mlx5 network adapter functionality. The issue is specific to configurations using Mellanox network adapters in environments where virtual functions are created and managed with devlink. Systems with only physical function (non-virtualized) Mellanox deployments or systems without Mellanox adapters are not affected. The kernel must be actively using the mlx5_core driver module for the path to be executed.

Exploitability

The vulnerability requires local access to the system and the ability to perform vport state changes or trigger ESW event handling. The attack vector is local with low privileges (PR:L); no special user interaction is required once the precondition is met. However, reliable exploitation requires knowledge of when ESW vport change events occur, which are typically triggered through devlink configuration changes in administrative contexts. Practical exploits would likely focus on denial-of-service (kernel panic) rather than information disclosure or privilege escalation, as the overflow occurs during a read operation into an undersized buffer. The vulnerability is not currently tracked on the CISA KEV catalog.

Remediation

Apply a patched kernel version that includes the fix to mlx5_query_nic_vport_mac_list(). The fix involves updating the function to query each vport's individual HCA capabilities and to internally manage MAC list allocation and return. This eliminates the assumption that all vports match the PF's capacity. Verify the specific patch version from your Linux distribution or the upstream kernel repository, as the published date is 2026-06-25. Until patching is possible, restrict devlink access and vport management to trusted administrators and monitor for kernel KASAN warnings related to mlx5 MAC list queries.

Patch guidance

Obtain and install the kernel update from your Linux distribution (Red Hat, Ubuntu, SUSE, Debian, etc.) that addresses CVE-2026-53230. The patch resolves the buffer sizing logic in the mlx5 driver. Verify compatibility with your Mellanox adapter firmware version and test in a non-production environment first, as kernel updates affect overall system stability. If you maintain a custom or vendor-supplied kernel, check with your vendor for an updated release or apply the upstream patch directly after validation. Monitor the kernel repository and your distribution's security advisories for the exact version numbers.

Detection guidance

Monitor kernel logs for KASAN warnings mentioning 'mlx5_query_nic_vport_mac_list' or 'slab-out-of-bounds' in the mlx5_core module, typically appearing in dmesg or system journals. These warnings indicate exploitation attempts or triggering of the vulnerability. Audit devlink configuration changes on systems with Mellanox adapters using tools like 'devlink port list' and 'devlink dev param show'. Enable kernel address sanitizer (KASAN) at boot (kasan=on) on test/staging systems to catch memory safety issues early. Monitor for unexpected kernel panics or ESW (eSwitch) worker thread crashes (esw_vport_change_handler or esw_update_vport_addr_list) on systems with Mellanox virtual functions.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (8.7), local privilege requirement with confidentiality and availability impact, and the high likelihood of triggering in virtualized/containerized environments that use Mellanox adapters. Although not yet on the CISA KEV catalog, the kernel compromise vector and potential for coordinated denial of service in multi-tenant systems elevates urgency. For organizations operating large Mellanox deployments in cloud or HPC environments, this is an immediate patching priority. Non-virtualized or Mellanox-free deployments can follow a standard update cycle.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects: Local Attack Vector (kernel privilege boundary violated), Low complexity, Low privileges required (any unprivileged user can trigger vport events in shared systems), Confidentiality High (kernel memory is readable via the buffer overflow), Integrity Low (limited write capability), and Availability High (kernel panic is probable). The Scope Changed rating indicates impact beyond the vulnerable component (entire kernel and system availability). While not Critical, the combination of reliable trigger conditions and serious kernel-level impact justifies HIGH severity.

Frequently asked questions