Live › vulnerability › CVE-2026-98807
Go to dashboardThe Mellanox mlx5 driver in the Linux kernel reads bonding-specific structures when handling events from team devices, which are smaller than the bonding structures, causing a slab out-of-bounds memory access. The sources do not state what an attacker can do with it beyond the memory fault detected by KASAN.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts with Mellanox ConnectX NICs using the mlx5 driver and a team device (link aggregation) configured. Systems using bonding only or without mlx5 hardware are not affected by this flaw. The sources do not give a fixed version number.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel release in the upstream commit (unknown in sources)lsmod | grep mlx5_core and teamdctl or ip link show type teamEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix slab-out-of-bounds when handling team device events
The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions check for LAG masters (which includes both bonding and team devices) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds memory access since team_port is smaller than bond slave.
Fix this by wrapping the bond-specific API calls with a check for bonding devices. This allows the function to still process LAG events for both bonding and teams but only calls bond-specific functions when dealing with actual bonding devices.
For mlx5_handle_changeinfodata_event(), keep the explicit bond check as mlx5 doesn't handle state information for team ports anyway.
Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
This page as .md · .json · in your agent: get_signal("CVE-2026-98807")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.