All vulnerabilities
CVE-2026-98807

Linux: net/mlx5: Fix slab-out-of-bounds when handling team device events

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16ca0e79f31ea810346a79dda545ba344ede1d47Also 3a6e67ff267af2053a793825c3b7844741fed461, 8117cbc504cb01980258d8a8c9be8f57cf0aaceb and 1 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 16ca0e79f31ea810346a79dda545ba344ede1d47LinuxCVE List
  • 3a6e67ff267af2053a793825c3b7844741fed461LinuxCVE List
  • 8117cbc504cb01980258d8a8c9be8f57cf0aacebLinuxCVE List
  • 04c824940d52871c49866a4ac67b504146f7cf35LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix slab-out-of-bounds when handling team device events

The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions check for LAG masters (which includes both bonding and team devices) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds memory access since team_port is smaller than bond slave.

Fix this by wrapping the bond-specific API calls with a check for bonding devices. This allows the function to still process LAG events for both bonding and teams but only calls bond-specific functions when dealing with actual bonding devices.

For mlx5_handle_changeinfodata_event(), keep the explicit bond check as mlx5 doesn't handle state information for team ports anyway.

Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:

  • Bonding: PASS (no regressions)
  • Team device: PASS (no KASAN errors)

Text from CVE List

Affected versions 10

  • Linuxaffected: 54493a08e21f46446b3b24577c5a6f229d049757 before 16ca0e79f31ea810346a79dda545ba344ede1d47CVE List
  • Linuxaffected: 54493a08e21f46446b3b24577c5a6f229d049757 before 3a6e67ff267af2053a793825c3b7844741fed461CVE List
  • Linuxaffected: 54493a08e21f46446b3b24577c5a6f229d049757 before 8117cbc504cb01980258d8a8c9be8f57cf0aacebCVE List
  • Linuxaffected: 54493a08e21f46446b3b24577c5a6f229d049757 before 04c824940d52871c49866a4ac67b504146f7cf35CVE List
  • Linuxaffected: 5.18CVE List
  • Linuxunaffected: all versions before 5.18CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4