Cloudanix VulnDB

CVE-2026-80667

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug for specific hardware can cause parts of the system to stop responding until restarted.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing complete() call in mlx5_mpesw_work() when mlx5_lag_get_devcom_comp() returns NULL leaves the waiter on mpesw->comp blocked indefinitely.

Why it matters to the business

Systems using mlx5 LAG/MPESW networking may experience kernel-level hangs that disrupt network traffic and require reboots, increasing downtime for dependent services.

How an attack unfolds

An attacker triggers the mlx5_mpesw_work path under conditions where devcom lookup fails, causing the queued work item to return early without waking the blocked caller.

How to fix it

Apply the upstream kernel patch that routes the early-return path through a complete label to guarantee the waiter is always woken.

How to confirm the fix worked

Inspect the mlx5 LAG source for the added complete label on the devcom NULL path and confirm the change is present after update.

Typical attack path

  1. Reach mlx5_mpesw_work execution
  2. Force mlx5_lag_get_devcom_comp to return NULL
  3. Block indefinitely on mpesw->comp

How to detect it

Examine kernel logs and task traces for processes blocked on mpesw completion combined with mlx5 LAG devcom errors.

What your security team should do

  • Track stable kernel releases containing the MPESW fix
  • Prioritize updates on systems with mlx5 LAG enabled
  • Validate the patch in test environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error mlx5_mpesw_work() returned without calling complete() when mlx5_lag_get_devcom_comp() returned NULL. A caller that queued the work and waited on mpesww->comp would block indefinitely. Funnel the early-return path through a new "complete" label so the waiter is always woken.

Affected packages

Ecosystem Package Introduced Fixed