CVE-2026-98807: Linux kernel · net/mlx5: Fix slab-out-of-bounds when handling team device events
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 8117cbc504cb01980258d8a8c9be8f57cf0aaceb : patch Linux kernel soon.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8117cbc504cb01980258d8a8c9be8f57cf0aaceb, 16ca0e79f31ea810346a79dda545ba344ede1d47, 04c824940d52871c49866a4ac67b504146f7cf35 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to 8117cbc504cb01980258d8a8c9be8f57cf0aaceb, 16ca0e79f31ea810346a79dda545ba344ede1d47, 04c824940d52871c49866a4ac67b504146f7cf35 or 3a6e67ff267af2053a793825c3b7844741fed461.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel source code as indicated by the fixed commit hashes. Users should update to a kernel version that includes these fixes to prevent the slab-out-of-bounds memory access. No additional mitigation steps are required beyond applying the official patch.
Description
A slab-out-of-bounds memory access vulnerability in the Linux kernel's mlx5 driver was fixed. The issue occurred when handling team device events, where bonding-specific APIs were incorrectly called on team_port structures, causing out-of-bounds access detected by KASAN. The fix ensures bonding-specific functions are only called for actual bonding devices, preventing memory errors.
References
- git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47 (opens in a new tab)
- git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461 (opens in a new tab)
- git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb (opens in a new tab)
- git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35 (opens in a new tab)