net/mlx5: Fix slab-out-of-bounds when handling team device events

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98807
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:34 UTC
Updated2026-10-19 10:19:44 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions check for LAG masters (which includes both bonding and team devices) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds memory access since team_port is smaller than bond slave. Fix this by wrapping the bond-specific API calls with a check for bonding devices. This allows the function to still process LAG events for both bonding and teams but only calls bond-specific functions when dealing with actual bonding devices. For mlx5_handle_changeinfodata_event(), keep the explicit bond check as mlx5 doesn't handle state information for team ports anyway. Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6: - Bonding: PASS (no regressions) - Team device: PASS (no KASAN errors)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 54493a08e21f46446b3b24577c5a6f229d049757 16ca0e79f31ea810346a79dda545ba344ede1d47 git Not specified
CNA Linux Linux affected 54493a08e21f46446b3b24577c5a6f229d049757 3a6e67ff267af2053a793825c3b7844741fed461 git Not specified
CNA Linux Linux affected 54493a08e21f46446b3b24577c5a6f229d049757 8117cbc504cb01980258d8a8c9be8f57cf0aaceb git Not specified
CNA Linux Linux affected 54493a08e21f46446b3b24577c5a6f229d049757 04c824940d52871c49866a4ac67b504146f7cf35 git Not specified
CNA Linux Linux affected 5.18 Not specified
CNA Linux Linux unaffected 5.18 semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.56 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.10 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report