CVE-2026-98807: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98807 Overview

CVE-2026-98807 is a slab-out-of-bounds memory access vulnerability in the Linux kernel's Mellanox mlx5 Ethernet driver. The flaw resides in the Link Aggregation (LAG) event handlers mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event(). These functions treat all LAG master devices identically but invoke bonding-specific APIs such as bond_slave_get_rcu() and bond_is_slave_inactive() on team port structures. Because team_port is smaller than a bond slave structure, the access reads beyond the allocated slab object. Kernel Address Sanitizer (KASAN) detects the condition and reports an out-of-bounds read when team devices generate netdev events on systems using Mellanox ConnectX adapters.

Critical Impact
Out-of-bounds slab reads in kernel netdev event paths can trigger memory corruption, kernel information disclosure, or system instability on hosts combining mlx5 NICs with team-based link aggregation.

Affected Products

Linux kernel net/mlx5 Ethernet driver (upstream)
Systems using Mellanox ConnectX adapters with team-device link aggregation
Stable kernel branches tracked by the four referenced commits

Discovery Timeline

2026-10-18 - CVE-2026-98807 published to the National Vulnerability Database
2026-10-19 - Last updated in the NVD database

Technical Details for CVE-2026-98807

Vulnerability Analysis

The Linux kernel supports two forms of link aggregation: the legacy bonding driver and the newer team driver. Both register upper-device relationships that drivers observe through netdev notifier chains. The mlx5 driver listens for NETDEV_CHANGEUPPER and NETDEV_CHANGEINFODATA events to maintain its LAG offload state.

Inside the affected handlers, the code identifies the slave network device and casts its private area to a bond slave structure before calling bonding-only helpers. When the slave belongs to a team device, the private memory is a team_port object, which is smaller than the expected slave structure. The subsequent field accesses read past the end of the allocation, producing the KASAN-reported slab-out-of-bounds condition.

The upstream fix wraps the bond-specific calls with a netif_is_bond_master()-style check so that only genuine bonding devices invoke bonding helpers. For mlx5_handle_changeinfodata_event(), an explicit bond check is retained because mlx5 does not process state information for team ports.

Root Cause

The root cause is improper type validation of LAG upper devices before dereferencing driver-specific private data [CWE-125, Out-of-Bounds Read]. The handlers assumed bond semantics for every LAG master, ignoring the structural difference between bond slaves and team_port entries.

Attack Vector

Triggering the condition requires a local administrator to configure a team device whose members include an mlx5-managed interface, then generate netdev change events such as adding or removing a port. No remote attack path is documented in the advisory. The resulting read is bounded by surrounding slab metadata and typically manifests as a KASAN splat or, on non-KASAN kernels, as unstable behavior derived from reading unrelated memory.

See the upstream fix in Kernel Git Commit 3a6e67f for the exact code change.

Detection Methods for CVE-2026-98807

Indicators of Compromise

KASAN reports referencing mlx5_handle_changeupper_event or mlx5_handle_changeinfodata_event in the kernel log
BUG: KASAN: slab-out-of-bounds entries that originate from the net/mlx5 LAG code paths
Unexpected mlx5 LAG state transitions coinciding with team device reconfiguration

Detection Strategies

Enable KASAN on test or canary kernels running mlx5 drivers to surface the exact out-of-bounds access during team device event handling.
Correlate dmesg output with ip link changes on team interfaces whose members are Mellanox ConnectX ports.
Inventory hosts that combine the team kernel module with mlx5-managed interfaces to prioritize patch validation.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline and alert on KASAN or WARN/BUG strings referencing mlx5.
Track team and bond topology changes using the netlink audit trail to identify risky configurations.
Validate kernel package versions across the fleet against the fixed stable commits listed in the vendor references.

How to Mitigate CVE-2026-98807

Immediate Actions Required

Apply the stable kernel updates containing commits 04c8249, 16ca0e7, 3a6e67f, and 8117cbc.
Reboot affected hosts after kernel upgrade to load the fixed mlx5 driver.
Audit all servers running Mellanox ConnectX adapters configured with team-based link aggregation.

Patch Information

The fix wraps bonding-specific API calls in the mlx5 LAG event handlers with explicit bonding-device checks. It is distributed through the Linux stable tree in the four commits referenced above. Downstream distributions will ship updated kernel packages that incorporate these commits; consult your vendor's security tracker for exact package versions.

Workarounds

Replace team-device link aggregation with the bonding driver on affected mlx5 hosts until patches are deployed.
Avoid reconfiguring team interfaces that include mlx5 ports on unpatched kernels to reduce exposure to the vulnerable event path.
Where feasible, unload the team module on systems that do not require team-based aggregation.

bash

# Verify running kernel includes one of the fix commits
uname -r
# Example: check for team devices bound to mlx5 interfaces
ip -d link show type team
ethtool -i <iface> | grep -i driver