In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The… (CVE-2026-98807)

The Linux kernel vulnerability CVE-2026-98807 concerns the mlx5 driver functions mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event(). These functions handle Link Aggregation Group (LAG) events for both bonding and team devices but incorrectly call bonding-specific APIs on team device structures. Since team_port structures are smaller than bond_slave structures, this leads to slab out-of-bounds memory access detected by Kernel Address Sanitizer (KASAN). The patch introduces conditional checks to call bonding-specific APIs only when the device is a bonding device, preserving correct handling of team devices without causing memory errors. The fix was tested on Mellanox ConnectX-5 hardware with Linux kernel 7.2.0-rc6, showing no regressions and eliminating KASAN errors.

The vulnerability causes out-of-bounds memory access in kernel space when processing team device events in the mlx5 driver. This could lead to kernel memory corruption or instability. However, no known exploits in the wild have been reported. The issue is specific to handling LAG events involving team devices and bonding devices in the mlx5 driver.

A fix is available that adds proper checks to ensure bonding-specific APIs are only called for bonding devices, preventing out-of-bounds memory access. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.