CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events
A slab-out-of-bounds memory access in the Linux kernel mlx5 driver allows local attackers to cause a denial of service via team device events.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98807?
CVE-2026-98807 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix slab-out-of-bounds when handling team device events
The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions check for LAG masters (which includes both bonding and team devices) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds memory access since team_port is smaller than bond slave.
Fix this by wrapping the bond-specific API calls with a check for bonding devices. This allows the function to still process LAG events for both bonding and teams but only calls bond-specific functions when dealing with actual bonding devices.
For mlx5_handle_changeinfodata_event(), keep the explicit bond check as mlx5 doesn't handle state information for team ports anyway.
Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6: - Bonding: PASS (no regressions) - Team device: PASS (no KASAN errors)
Which versions are affected by CVE-2026-98807?
How do I fix CVE-2026-98807?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98807 being exploited?
There is no known exploitation of CVE-2026-98807 in the wild and no public exploit code.
Sources
Also known as AZL-108909, BELL-CVE-2026-98807, DEBIAN-CVE-2026-98807, GHSA-7rpx-hg5j-v22f, UBUNTU-CVE-2026-98807.