SB20261022423 - Out-of-bounds read in Linux kernel core lag driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an out-of-bounds read in the mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions when processing team device events. A local privileged user can trigger team device events that cause bonding-specific APIs to interpret smaller team_port structures as bond slave structures, potentially causing a kernel crash.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35
• https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47
• https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461
• https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb