---
id: "CVE-2026-98807"
kind: "vulnerability"
aliases: ["CVE-2026-98807"]
title: "Linux kernel: mlx5 driver out-of-bounds read on team device events"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "mellanox-connectx", "mlx5", "self-hosted", "team-driver"]
not_affected_if: ["bonding-only", "no-mlx5-hardware", "no-team-devices"]
published_at: "2026-10-18T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:14:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98807", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: mlx5 driver out-of-bounds read on team device events

The Mellanox mlx5 driver in the Linux kernel reads bonding-specific structures when handling events from team devices, which are smaller than the bonding structures, causing a slab out-of-bounds memory access. The sources do not state what an attacker can do with it beyond the memory fault detected by KASAN.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel release in the upstream commit (unknown in sources)
- Check whether the host uses the mlx5 driver with team devices: `lsmod | grep mlx5_core` and `teamdctl` or `ip link show type team`

## Fix

- Update the Linux kernel to a release containing the mlx5 fix (version unknown in sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98807

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix slab-out-of-bounds when handling team device events

The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
functions check for LAG masters (which includes both bonding and team
devices) but only call bonding-specific APIs. When processing team device
events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
team_port structures causes KASAN to detect an out-of-bounds memory access
since team_port is smaller than bond slave.

Fix this by wrapping the bond-specific API calls with a check for bonding
devices. This allows the function to still process LAG events for both
bonding and teams but only calls bond-specific functions when dealing with
actual bonding devices.

For mlx5_handle_changeinfodata_event(), keep the explicit bond check as
mlx5 doesn't handle state information for team ports anyway.

Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
- Bonding: PASS (no regressions)
- Team device: PASS (no KASAN errors)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_