A buffer size miscalculation in the Mellanox mlx5 driver’s mlx5_query_nic_vport_mac_list function causes a slab‑out‑of‑bounds read when a virtual function vport is configured with a maximum MAC list larger than the firmware reports. The overflow allows the kernel to read beyond the allocated buffer, potentially exposing kernel memory and creating an opportunity for privilege escalation or arbitrary code execution.

All Linux kernel releases that include the unpatched Mellanox mlx5 driver are affected, including the 7.0.0-rc6 kernel referenced in the advisory. Any distribution that ships a kernel containing the vulnerable code without the subsequent fix is impacted.

The CVSS score of 8.7 indicates high severity, while the EPSS score of <1% and lack of listing in the CISA KEV catalog suggest that active exploitation has not been observed. The most likely attack vector involves manipulating devlink settings on a Mellanox device to configure a VF vport with an oversized MAC list; this can be performed by local privileged processes or potentially by remote management interfaces that expose devlink commands, though such remote access is not explicitly documented in the advisory. The impact ranges from denial of service to full kernel compromise if the overflow is successfully triggered.