CVE-2026-98807

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix slab-out-of-bounds when handling team device events

The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()

functions check for LAG masters (which includes both bonding and team

devices) but only call bonding-specific APIs. When processing team device

events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on

team_port structures causes KASAN to detect an out-of-bounds memory access

since team_port is smaller than bond slave.

Fix this by wrapping the bond-specific API calls with a check for bonding

devices. This allows the function to still process LAG events for both

bonding and teams but only calls bond-specific functions when dealing with

actual bonding devices.

For mlx5_handle_changeinfodata_event(), keep the explicit bond check as

mlx5 doesn't handle state information for team ports anyway.

Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:

- Bonding: PASS (no regre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References