CVE-2026-80667 Overview
CVE-2026-80667 is a Linux kernel vulnerability in the Mellanox mlx5 driver's Link Aggregation (LAG) Multi-Port E-Switch (MPESW) subsystem. The mlx5_mpesw_work() function returns early without calling complete() when mlx5_lag_get_devcom_comp() returns NULL. A caller that queued the work and waits on the mpesww->comp completion object blocks indefinitely. The upstream fix routes the early-return path through a new complete label so the waiter is always woken.
Critical Impact
A missed completion in the mlx5 LAG MPESW work handler leaves waiting kernel threads blocked indefinitely, producing a hang condition in the networking stack on affected Mellanox ConnectX deployments.
Affected Products
- Linux kernel net/mlx5 driver (LAG / MPESW subsystem)
- Systems using Mellanox ConnectX network adapters with LAG multi-port E-Switch enabled
- Distributions shipping unpatched Linux kernels referenced by the stable commits below
Discovery Timeline
- 2026-08-28 - CVE-2026-80667 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80667
Vulnerability Analysis
The defect resides in mlx5_mpesw_work(), the workqueue handler responsible for MPESW state transitions on Mellanox mlx5 devices. The handler receives a work item that embeds a struct completion (mpesww->comp). Callers queue the work and then block on that completion, expecting the worker to signal it before returning.
When mlx5_lag_get_devcom_comp() returns NULL, the original code exited the function without signaling completion. The waiter never observed the completion event and remained parked on the wait queue. This produces an indefinite kernel hang in the calling context, which is typically part of device configuration or teardown paths for LAG.
The patch introduces a unified complete label that all exit paths jump to, guaranteeing complete(&mpesww->comp) is invoked before the function returns. This is a control-flow correctness fix rather than a memory-safety issue.
Root Cause
The root cause is a missing completion signal on an error path — a control-flow defect where an early return bypassed the complete() call that waiters depend on. This is a classic missed-wakeup bug, categorized as a denial-of-service condition through resource/thread starvation.
Attack Vector
Triggering the condition requires local kernel state where mlx5_lag_get_devcom_comp() returns NULL, typically during LAG or MPESW reconfiguration on multi-port mlx5 devices. The condition is not remotely exploitable and requires privileged operations against the network stack. Impact is limited to a hung kernel task on the affected host.
No public proof-of-concept exists. See the upstream fixes at Linux Kernel Commit 4d720c6, Linux Kernel Commit 68cdbe4, Linux Kernel Commit 6a802de, and Linux Kernel Commit d4b85f9 for the corrected control flow.
Detection Methods for CVE-2026-80667
Indicators of Compromise
- Kernel hung_task warnings referencing mlx5_mpesw_work or callers waiting on mpesww->comp
- Stalled processes in uninterruptible sleep (D state) whose stack traces include mlx5 LAG code paths
- dmesg entries showing INFO messages from khungtaskd after 120 seconds of blocked task time on hosts with Mellanox ConnectX NICs
Detection Strategies
- Inventory Linux hosts running the mlx5 driver with LAG/MPESW enabled and compare kernel versions against the stable trees patched by commits 4d720c6, 68cdbe4, 6a802de, and d4b85f9.
- Alert on repeated hung_task_timeout_secs kernel messages referencing mlx5 symbols, which indicate the missed-wakeup condition has been triggered.
- Correlate LAG reconfiguration events (bond changes, devlink operations) with subsequent task hangs on the same host.
Monitoring Recommendations
- Ingest /var/log/kern.log and journalctl -k output into a centralized logging platform and search for mlx5, hung_task, and blocked for more than patterns.
- Track kernel package versions across the fleet and flag hosts still running pre-fix kernels on hardware with Mellanox adapters.
- Monitor network dataplane availability on LAG-bonded interfaces to catch degradation caused by hung configuration threads.
How to Mitigate CVE-2026-80667
Immediate Actions Required
- Identify all hosts running the mlx5_core module with LAG or MPESW configurations enabled.
- Schedule a kernel update to a version that incorporates the upstream fix commits listed in the references.
- Reboot affected systems after upgrade, since the fix is compiled into the kernel image or the mlx5_core module.
Patch Information
Apply the upstream Linux kernel fixes: Linux Kernel Commit 4d720c6, Linux Kernel Commit 68cdbe4, Linux Kernel Commit 6a802de, and Linux Kernel Commit d4b85f9. Downstream distribution kernels should pick up these commits in their next stable release. Consult your distribution's security tracker for the specific package version containing the backport.
Workarounds
- Avoid MPESW reconfiguration operations on production hosts until the patched kernel is deployed.
- Where feasible, disable LAG multi-port E-Switch on mlx5 devices to prevent execution of the affected code path.
- Set kernel.hung_task_panic=0 and monitor hung_task warnings so operators are alerted before a full service outage develops.
# Verify the running kernel and mlx5 module version
uname -r
modinfo mlx5_core | grep -E '^(version|srcversion|filename):'
# Watch for missed-wakeup symptoms in the kernel log
dmesg -T | grep -Ei 'mlx5|hung_task|blocked for more than'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.