CVE-2026-98807

What it actually does

The mlx5 driver incorrectly invokes bonding-specific APIs (bond_slave_get_rcu, bond_is_slave_inactive) on smaller team_port structures during LAG event handling in mlx5_handle_changeupper_event and mlx5_handle_changeinfodata_event, producing slab-out-of-bounds memory access.

Why it matters to the business

Systems using Mellanox ConnectX adapters with Linux team or bonding LAG configurations risk kernel crashes, denial of service, or potential local privilege escalation, interrupting network connectivity and server availability.

How an attack unfolds

An attacker with local access configures or manipulates a team LAG device to emit changeupper or changeinfodata events; the mlx5 handler then calls bonding functions on the mismatched team_port layout, triggering out-of-bounds reads/writes that may be leveraged for code execution or crashes.

How to fix it

Apply the upstream kernel fix that adds explicit bonding-device checks before calling bond_slave_get_rcu or bond_is_slave_inactive inside the mlx5 event handlers; rebuild and boot the patched kernel on affected systems.

How to confirm the fix worked

Inspect the mlx5 source for the presence of is_bond_master or equivalent bonding-type guards wrapping the bond_* calls in mlx5_handle_changeupper_event and mlx5_handle_changeinfodata_event; confirm absence of KASAN reports during team-device testing.

Typical attack path

1. Obtain local access on a host with mlx5 hardware
2. Create or modify a team LAG master device
3. Generate netdev event notifications for the team device
4. mlx5 LAG handlers invoke bond-specific RCU and state checks on team_port
5. KASAN-detected slab OOB access occurs, enabling crash or further exploitation

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds reports containing mlx5_handle_changeupper_event, mlx5_handle_changeinfodata_event, bond_slave_get_rcu, or team_port references; correlate with netdev event timestamps.

• mlx5_handle_changeupper_event
• mlx5_handle_changeinfodata_event
• bond_slave_get_rcu called on team_port
• KASAN: slab-out-of-bounds in mlx5 LAG

What your security team should do

• Patch Linux kernels on all mlx5-equipped hosts within the next maintenance window
• Temporarily disable team LAG configurations on mlx5 hardware until patched
• Add kernel log monitoring for KASAN or slab OOB messages referencing mlx5 LAG handlers
• Review downstream package updates that include the referenced commit for distribution-specific kernels