A buffer size miscalculation in the mlx5_query_nic_vport_mac_list function can cause a slab‑out‑of‑bounds read when a virtual function vport is configured with a maximum MAC list larger than the firmware reports. The overflow allows the kernel to read beyond the allocated buffer, exposing kernel memory and providing a foothold for privilege escalation or arbitrary code execution. The bug is a classic out‑of‑bounds read violation that can be triggered by an attacker with sufficient control over device configuration.

The flaw resides in the Linux kernel’s Mellanox mlx5 driver and affects all kernel releases that ship the unpatched driver, regardless of distribution. Any system running a kernel version that has not yet incorporated the fix for this issue is impacted, including the 7.0.0‑rc6 release referenced in the advisory.

The advisory does not list an EPSS score or KEV status, indicating that exploitation has not been observed in the wild and there is no known active exploitation campaign. However, the vulnerability is in core kernel code; an attacker would need the ability to modify devlink settings for a Mellanox device or otherwise influence the vport configuration. This could be achieved by local privileged processes or by remote attacks that exploit management interfaces exposed by the device. The potential impact ranges from a denial of service through a kernel crash to full system compromise if an attacker can trigger the overflow and manipulate the memory access patterns.