The vulnerability resides in the vdpa/mlx5 driver of the Linux kernel. It occurs when create_direct_keys() calculates an input buffer size that includes the out, in, and mtt structures, but passes a pointer to only the in portion of the buffer to cmd_exec(). The size passed therefore exceeds the actual allocated region by the size of the out structure, resulting in a slab‑out‑of‑bounds read of sixteen bytes beyond the allocated 4384‑byte buffer. This out‑of‑bounds read can expose kernel memory contents and may corrupt kernel state. Although the flaw does not provide direct remote code execution, it can facilitate local privilege escalation or destabilize the system by leaking sensitive data or corrupting memory used by control flow. The path to exploitation requires an attacker who can send commands to an mlx5 virtual DPDK device, typically implying local or privileged access to the kernel. Based on the description, it is inferred that an attacker must control the vDPA device to craft a malicious command that triggers the out‑of‑bounds read, implying that local or privileged access to the kernel is required for exploitation.

Linux distributions that ship the Linux kernel with the vdpa and mlx5 drivers compiled as modules or built‑in. The vulnerability affects kernels that contain the unpatched version of the vdpa/mlx5 driver; no specific version constraints are listed. All systems running such kernels are potentially vulnerable until the vendor releases a patch or the driver is upgraded.

The CVSS score of 9.3 indicates critical risk. Because the flaw requires local interaction with the vDPA driver, a local attacker or privileged process could read sensitive information or corrupt kernel structures. The EPSS score of < 1% suggests a very low probability of exploitation in the wild. The absence from KEV indicates that no large‑scale supply‑chain attacks are presently underway. The kernel developers have addressed the issue via a patch that properly calculates the buffer size; applying that patch removes the out‑of‑bounds read. Until the patch is deployed, administrators should evaluate whether the vDPA and mlx5 drivers are required on their systems, and consider disabling or restricting access as a mitigating measure. Based on the description, it is inferred that the attack vector is local or privileged access, as the exploit requires sending commands to the vDPA driver from within the kernel context.