{"schema":"threatline.record/2","record":{"id":"CVE-2026-98807","aliases":[],"summary":"net/mlx5: Fix slab-out-of-bounds when handling team device events","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call bonding-specific APIs. When processing team device\nevents, calling bond_slave_get_rcu() and bond_is_slave_inactive() on\nteam_port structures causes KASAN to detect an out-of-bounds memory access\nsince team_port is smaller than bond slave.\n\nFix this by wrapping the bond-specific API calls with a check for bonding\ndevices. This allows the function to still process LAG events for both\nbonding and teams but only calls bond-specific functions when dealing with\nactual bonding devices.\n\nFor mlx5_handle_changeinfodata_event(), keep the explicit bond check as\nmlx5 doesn't handle state information for team ports anyway.\n\nTested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:\n- Bonding: PASS (no regressions)\n- Team device: PASS (no KASAN errors)","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"54493a08e21f46446b3b24577c5a6f229d049757","lessThan":"16ca0e79f31ea810346a79dda545ba344ede1d47","status":"affected","versionType":"git"},{"version":"54493a08e21f46446b3b24577c5a6f229d049757","lessThan":"3a6e67ff267af2053a793825c3b7844741fed461","status":"affected","versionType":"git"},{"version":"54493a08e21f46446b3b24577c5a6f229d049757","lessThan":"8117cbc504cb01980258d8a8c9be8f57cf0aaceb","status":"affected","versionType":"git"},{"version":"54493a08e21f46446b3b24577c5a6f229d049757","lessThan":"04c824940d52871c49866a4ac67b504146f7cf35","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.56","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.10","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"16ca0e79f31ea810346a79dda545ba344ede1d47","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"3a6e67ff267af2053a793825c3b7844741fed461","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"8117cbc504cb01980258d8a8c9be8f57cf0aaceb","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","source_modified_at":"2026-10-19T09:26:00.670Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"04c824940d52871c49866a4ac67b504146f7cf35","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00175,"percentile":0.06671,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:48:53.992Z","modified_at":"2026-10-19T09:26:00.670Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98807","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:26:00.670Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98807","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:26:00.670Z","content_hash":"613060da75fadb626a2069455ba1da8371926a47a14fe256282c48b2e876d56c"}}