{"id":"CVE-2026-98807","revision":"702a487d2494467c8f258ae36ca66e35","records":[{"revision":"702a487d2494467c8f258ae36ca66e35","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98807","aliases":[],"title":"net/mlx5: Fix slab-out-of-bounds when handling team device events","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call bonding-specific APIs. When processing team device\nevents, calling bond_slave_get_rcu() and bond_is_slave_inactive() on\nteam_port structures causes KASAN to detect an out-of-bounds memory access\nsince team_port is smaller than bond slave.\n\nFix this by wrapping the bond-specific API calls with a check for bonding\ndevices. This allows the function to still process LAG events for both\nbonding and teams but only calls bond-specific functions when dealing with\nactual bonding devices.\n\nFor mlx5_handle_changeinfodata_event(), keep the explicit bond check as\nmlx5 doesn't handle state information for team ports anyway.\n\nTested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:\n- Bonding: PASS (no regressions)\n- Team device: PASS (no KASAN errors)","state":0,"publishedAt":"2026-10-18T15:48:53.992+00:00","modifiedAt":"2026-10-19T09:26:00.67+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"54493a08e21f46446b3b24577c5a6f229d049757\",\n                            \"lessThan\": \"16ca0e79f31ea810346a79dda545ba344ede1d47\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54493a08e21f46446b3b24577c5a6f229d049757\",\n                            \"lessThan\": \"3a6e67ff267af2053a793825c3b7844741fed461\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54493a08e21f46446b3b24577c5a6f229d049757\",\n                            \"lessThan\": \"8117cbc504cb01980258d8a8c9be8f57cf0aaceb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54493a08e21f46446b3b24577c5a6f229d049757\",\n                            \"lessThan\": \"04c824940d52871c49866a4ac67b504146f7cf35\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47","https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461","https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb","https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98807","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98807","identifiers":["CVE-2026-98807"]},"retained":false,"historicalAffected":[]}],"coverage":[]}