CVE-2026-68293: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68293 Overview

CVE-2026-68293 is a buffer overflow vulnerability in the Linux kernel's Mellanox mlx5 network driver. The flaw resides in the handling of the Management Cable Info Access (MCIA) register, which can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability. However, struct mlx5_ifc_mcia_reg_bits only defines dword_0..11, providing space for just 12 dwords (48 bytes). The function mlx5_query_mcia() calls memcpy() using a clamped size that can exceed the output buffer, reading past its end. Kernels built with FORTIFY_SOURCE detect the condition and trigger a kernel panic when reading module EEPROM via ethtool.

Critical Impact
A local user with sufficient privileges to query network module EEPROM data can trigger a kernel buffer overflow leading to system crash and denial of service on affected Mellanox mlx5 hardware.

Affected Products

Linux kernel builds containing the net/mlx5 driver with the vulnerable mlx5_ifc_mcia_reg_bits layout
Systems using Mellanox NICs that advertise the mcia_32dwords capability
Kernels compiled with CONFIG_FORTIFY_SOURCE enabled (panic path)

Discovery Timeline

2026-08-10 - CVE-2026-68293 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68293

Vulnerability Analysis

The vulnerability is a stack or heap buffer over-read in the mlx5_core kernel module. The MCIA register is used to read information from pluggable transceiver modules attached to Mellanox network interface cards. When a device advertises the mcia_32dwords capability, the hardware can return up to 128 bytes of module data per read. The kernel's register description structure mlx5_ifc_mcia_reg_bits was never extended to match this capability and still defines only dword_0 through dword_11, giving 48 bytes of storage.

The function mlx5_query_mcia() uses mlx5_mcia_max_bytes() to clamp the number of bytes to copy. That helper returns up to 128 bytes when the extended capability is present. The subsequent memcpy() then reads bytes beyond the actual size of the out structure. On kernels compiled with FORTIFY_SOURCE, the runtime check invokes fortify_panic+0x13/0x20, resulting in kernel BUG at lib/string_helpers.c:1048.

Root Cause

The defect is a size mismatch between the hardware capability description and the kernel's C structure layout. Runtime code trusted the device-advertised maximum size while the compile-time buffer definition remained smaller. Reachable call paths include mlx5_query_module_eeprom_by_page(), mlx5e_get_module_eeprom_by_page(), eeprom_prepare_data(), and ethnl_default_doit(), invoked when userland queries the module EEPROM through ethtool netlink.

Attack Vector

An authenticated local user with permission to issue ethtool module EEPROM queries against an affected Mellanox interface can trigger the overflow. Successful exploitation aborts kernel execution through the FORTIFY panic path, producing a denial-of-service condition. Confidentiality impact stems from the potential to read adjacent kernel memory into the userland-returned buffer when FORTIFY is not enabled. See the Linux kernel fix commit 87b39a8 for the exact patched code path.

// Vulnerability description only - see upstream patches for the fix
// The mcia_reg layout is extended from dword_0..11 to 32 dwords
// so that memcpy() in mlx5_query_mcia() no longer reads past 'out'.

Detection Methods for CVE-2026-68293

Indicators of Compromise

Kernel panic messages containing detected buffer overflow in memcpy followed by fortify_panic+0x13/0x20
Stack traces referencing mlx5_query_mcia, mlx5_query_module_eeprom_by_page, or mlx5e_get_module_eeprom_by_page from mlx5_core
Unexpected system reboots or crashes correlated with ethtool module EEPROM queries against Mellanox NICs

Detection Strategies

Inventory Linux hosts running Mellanox mlx5-based network cards and identify those advertising the mcia_32dwords capability using mlx5tool or mstflint
Compare running kernel versions against distribution advisories referencing the patch commits 11c057d, 5be4eed, 87b39a8, and 88b2a16
Alert on ethtool invocations targeting module EEPROM pages on hosts that have not been patched

Monitoring Recommendations

Ship dmesg and /var/log/kern.log output to a central log platform and alert on fortify_panic and mlx5_query_mcia symbols
Monitor auditd for executions of ethtool with -m or --module-info arguments on production Mellanox hosts
Track unexpected NIC driver reloads and kernel oops events across the fleet

How to Mitigate CVE-2026-68293

Immediate Actions Required

Apply the vendor kernel update from your Linux distribution that incorporates the upstream net/mlx5 MCIA register fix
Restrict ethtool module EEPROM query permissions to trusted administrators using sudo policy and CAP_NET_ADMIN boundaries
Identify hosts with Mellanox NICs advertising mcia_32dwords and prioritize them for patching

Patch Information

The fix extends the mcia_reg layout to 32 dwords so that the destination buffer matches the maximum hardware read size. Upstream patches are available in the stable tree: 11c057d, 5be4eed, 87b39a8, and 88b2a16. Apply the corresponding backport from your distribution vendor.

Workarounds

Remove or restrict user access to ethtool binaries where module EEPROM inspection is not required
Disable services that periodically poll module EEPROM data on affected Mellanox interfaces until patching completes
On kernels with CONFIG_FORTIFY_SOURCE disabled, enable it to convert silent memory disclosure into a controlled panic while patches are staged

bash

# Verify kernel and driver, then plan an update
uname -r
modinfo mlx5_core | grep -E 'version|filename'
ethtool -i <ifname> | grep -E 'driver|firmware'

# Restrict ethtool module EEPROM access to root only
chmod 750 /usr/sbin/ethtool