The Linux kernel vdpa/mlx5 driver contained a vulnerability where create_direct_keys() incorrectly calculated the buffer length for input data. The function's size calculation included the entire structure (out + in + mtt[]), but the pointer passed to cmd_exec pointed only to the 'in' field, skipping the 'out' field. This mismatch caused mlx5_copy_to_msg() to read beyond the allocated buffer by the size of the 'out' field, resulting in a slab-out-of-bounds read. The issue was identified via KASAN reports and fixed by properly calculating the input size to match the pointer and allocation size.

The vulnerability causes a read beyond the allocated buffer in kernel space, which can lead to memory corruption or kernel instability. While no direct exploit in the wild is known, such out-of-bounds reads can potentially be leveraged for denial of service or information disclosure under certain conditions.

A fix has been implemented in the Linux kernel to correct the buffer length calculation in create_direct_keys(). Users should update to the fixed kernel version once available. Patch status is not yet confirmed from vendor advisory; check the official Linux kernel repositories or advisories for the specific patch and update guidance.