{"id":"CVE-2026-98807","kind":"vulnerability","aliases":["CVE-2026-98807"],"related":[],"title":"Linux kernel: mlx5 driver out-of-bounds read on team device events","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call bonding-specific APIs. When processing team device\nevents, calling bond_slave_get_rcu() and bond_is_slave_inactive() on\nteam_port structures causes KASAN to detect an out-of-bounds memory access\nsince team_port is smaller than bond slave.\n\nFix this by wrapping the bond-specific API calls with a check for bonding\ndevices. This allows the function to still process LAG events for both\nbonding and teams but only calls bond-specific functions when dealing with\nactual bonding devices.\n\nFor mlx5_handle_changeinfodata_event(), keep the explicit bond check as\nmlx5 doesn't handle state information for team ports anyway.\n\nTested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:\n- Bonding: PASS (no regressions)\n- Team device: PASS (no KASAN errors)","summary":"The Mellanox mlx5 driver in the Linux kernel reads bonding-specific structures when handling events from team devices, which are smaller than the bonding structures, causing a slab out-of-bounds memory access. The sources do not state what an attacker can do with it beyond the memory fault detected by KASAN.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mellanox-connectx","mlx5","self-hosted","team-driver"],"not_affected_if":["bonding-only","no-mlx5-hardware","no-team-devices"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel release in the upstream commit (unknown in sources)\n- Check whether the host uses the mlx5 driver with team devices: `lsmod | grep mlx5_core` and `teamdctl` or `ip link show type team`","fix":"- Update the Linux kernel to a release containing the mlx5 fix (version unknown in sources)","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:14:58+00:00","updated_at":"2026-10-25T05:14:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:14:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release containing the mlx5 fix (version unknown in sources)","reach":"local","title":"Linux kernel: mlx5 driver out-of-bounds read on team device events","impact":"medium","summary":"The Mellanox mlx5 driver in the Linux kernel reads bonding-specific structures when handling events from team devices, which are smaller than the bonding structures, causing a slab out-of-bounds memory access. The sources do not state what an attacker can do with it beyond the memory fault detected by KASAN.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","mlx5","mellanox-connectx","team-driver","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory out-of-bounds access; impact beyond crash unknown","analyst_note":"Confirm the fixed kernel version and whether the flaw can be triggered beyond a KASAN-detected crash, using the upstream kernel commit referenced by NVD.","how_to_check":"- Run `uname -r` and compare against the fixed kernel release in the upstream commit (unknown in sources)\n- Check whether the host uses the mlx5 driver with team devices: `lsmod | grep mlx5_core` and `teamdctl` or `ip link show type team`","needs_analyst":true,"not_affected_if":["no-mlx5-hardware","bonding-only","no-team-devices"],"who_is_affected":"Hosts with Mellanox ConnectX NICs using the mlx5 driver and a team device (link aggregation) configured. Systems using bonding only or without mlx5 hardware are not affected by this flaw. The sources do not give a fixed version number.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":3611,"output_tokens":631,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-5':245C '-98807':16A,19A '7.2.0':248C 'access':68B,168C 'actual':217C 'allow':194C 'anyway':240C 'api':138C,185C 'attack':76B 'beyond':81B 'bond':44B,58B,128C,136C,145C,150C,175C,183C,191C,204C,211C,218C,228C,250C 'bond-specif':182C,210C 'bonding-specif':43B,135C 'bound':8A,66B,104C,166C 'call':134C,144C,186C,209C 'caus':60B,158C 'changeinfodata':118C,223C 'changeupp':113C 'check':121C,189C,229C 'connectx':26B,244C 'cve':14A,17A 'deal':215C 'detect':85B,161C 'devic':12A,52B,108C,131C,142C,192C,219C,255C 'doesn':232C 'driver':4A,33B,37B 'error':259C 'event':13A,49B,109C,114C,119C,143C,201C,224C 'explicit':227C 'fault':84B 'fix':99C,177C 'follow':93C 'function':120C,196C,213C 'get':147C 'handl':48B,106C,112C,117C,222C,234C 'host':30B 'inact':153C 'includ':126C 'inform':236C 'infrastructur':20B 'kasan':87B,159C,258C 'keep':225C 'kernel':2A,23B,41B,91C 'lag':123C,200C 'linux':1A,22B,40B,90C,247C 'linux-kernel':21B 'master':124C 'mellanox':25B,35B,243C 'mellanox-connectx':24B 'memori':67B,83B,167C 'mlx5':3A,27B,36B,111C,116C,221C,231C 'net/mlx5':98C 'out-of-bound':5A,63B,163C 'pass':251C,256C 'port':156C,171C,239C 'process':140C,199C 'rc6':249C 'rcu':148C 'read':9A,42B 'regress':253C 'resolv':97C 'self':29B 'self-host':28B 'sinc':169C 'slab':62B,101C 'slab-out-of-bound':100C 'slave':146C,152C,176C 'smaller':55B,173C 'sourc':70B 'specif':45B,137C,184C,212C 'state':73B,235C 'still':198C 'structur':46B,59B,157C 'team':11A,32B,51B,107C,130C,141C,155C,170C,206C,238C,254C 'team-driv':31B 'test':241C 'vulner':94C 'wrap':180C","nicknames":[],"mitigations":[],"who_affected":"Hosts with Mellanox ConnectX NICs using the mlx5 driver and a team device (link aggregation) configured. Systems using bonding only or without mlx5 hardware are not affected by this flaw. The sources do not give a fixed version number.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98807","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}