CVE-2026-90416 RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
A local attacker with debugfs access can trigger a stack out-of-bounds read in the RDMA mlx5 driver, potentially leaking kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90416?
CVE-2026-90416 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
get_param() reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as "-2147483648\n" whose full length is 12. snprintf() stores only 11 bytes yet returns 12, so simple_read_from_buffer() treats 12 bytes as valid and reads one byte past lbuf[].
Size the buffer for the widest unsigned decimal, format with "%u" to match the u32, and use scnprintf() so the length passed to simple_read_from_buffer() reflects the bytes actually stored.
Which versions are affected by CVE-2026-90416?
How do I fix CVE-2026-90416?
Apply the vendor's patch.
Is CVE-2026-90416 being exploited?
There is no known exploitation of CVE-2026-90416 in the wild and no public exploit code.
Sources
Also known as AZL-103044, BELL-CVE-2026-90416, DEBIAN-CVE-2026-90416, GHSA-5qwc-6c47-m348, UBUNTU-CVE-2026-90416.