CVE-2026-72344 (GCVE-0-2026-72344)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash[1]. Hence, skip the peer when lookup fails. Note: In case there are peer flows, they are cleaned before LAG cleared the master mark. [1] RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core] Call Trace: <TASK> mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core] mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core] mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core] mlx5_devcom_send_event+0x7a/0x140 [mlx5_core] mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core] mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core] mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core] mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core] mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core] mlx5e_detach_netdev+0x96/0xf0 [mlx5_core] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core] __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core] mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core] mlx5e_rep_remove+0x22/0x30 [mlx5_core] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xe8/0x1b0 device_del+0x159/0x3c0 mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core] mlx5_unregister_device+0x54/0x80 [mlx5_core] mlx5_uninit_one+0x73/0x130 [mlx5_core] remove_one+0x78/0xe0 [mlx5_core] pci_device_remove+0x39/0xa0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 971b28accc09436fe6a6d5afd667dcbfb3ed7e03 , < 5a95aa0198af75047d98fb72950642c89dab770f (git)
Affected: 971b28accc09436fe6a6d5afd667dcbfb3ed7e03 , < 7bed4af0ced82948d660205efecd551ef8bc3912 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a95aa0198af75047d98fb72950642c89dab770f",
              "status": "affected",
              "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03",
              "versionType": "git"
            },
            {
              "lessThan": "7bed4af0ced82948d660205efecd551ef8bc3912",
              "status": "affected",
              "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable\n\nmlx5_lag_get_dev_seq() will return error when the peer isn\u0027t in the LAG\nor when no device is marked as master. Result bad memory access and kernel\ncrash[1].\n\nHence, skip the peer when lookup fails.\n\nNote: In case there are peer flows, they are cleaned before LAG cleared\nthe master mark.\n\n[1]\nRIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core]\nCall Trace:\n \u003cTASK\u003e\n mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core]\n mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core]\n mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core]\n mlx5_devcom_send_event+0x7a/0x140 [mlx5_core]\n mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core]\n mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core]\n mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core]\n mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core]\n mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core]\n mlx5e_detach_netdev+0x96/0xf0 [mlx5_core]\n mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\n mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core]\n mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core]\n __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core]\n mlx5e_rep_remove+0x22/0x30 [mlx5_core]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xe8/0x1b0\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core]\n mlx5_unregister_device+0x54/0x80 [mlx5_core]\n mlx5_uninit_one+0x73/0x130 [mlx5_core]\n remove_one+0x78/0xe0 [mlx5_core]\n pci_device_remove+0x39/0xa0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mlx5e TC eswitch peer-flow teardown (mlx5e_tc_clean_fdb_peer_flows/mlx5e_tc_del_fdb_peers_flow), reached via local TC netlink, netdev/LAG reconfiguration, or driver unload\u2014not from processing remote network packets.\nAC:L - On mlx5 LAG/merged-eswitch systems, a caller with CAP_NET_ADMIN can install TC flower rules that create peer flows, then trigger LAG unpair/teardown so mlx5_lag_get_dev_seq() fails and the unchecked negative index is used reliably.\nPR:L - Exploitation requires CAP_NET_ADMIN to install/delete mlx5e TC cls_flower offload rules and manipulate LAG/bond state; CAP_NET_ADMIN is obtainable in user/network namespaces and is not init-namespace root.\nUI:N - No victim interaction is required; the crash occurs during kernel-initiated peer-flow cleanup when LAG sequence lookup fails during eswitch unpair or mlx5e netdev/driver teardown.\nS:U - Impact is kernel memory corruption and crash on the host running mlx5; it does not cross a VM/hypervisor, IOMMU, or other security boundary into a separate authority.\nC:H - mlx5_lag_get_dev_seq() errors (e.g., -ENOENT) are used unchecked as peer_flows[]/flow-\u003epeer[] indices, causing out-of-bounds list operations that read and corrupt adjacent kernel memory beyond the flow structures.\nI:H - The faulting list_del(\u0026flow-\u003epeer[peer_index]) and peer_flows[i] walks with a negative index perform out-of-bounds linked-list writes, corrupting kernel heap/metadata and enabling further memory control primitives.\nA:H - The fix commit documents a reproducible kernel crash (oops at mlx5e_tc_del_fdb_peers_flow) from this bad memory access during mlx5 eswitch/TC cleanup, causing complete loss of system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:03.143Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a95aa0198af75047d98fb72950642c89dab770f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bed4af0ced82948d660205efecd551ef8bc3912"
        }
      ],
      "title": "net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72344",
    "datePublished": "2026-08-15T05:55:49.751Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:43:03.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72344",
      "date": "2026-09-20",
      "epss": "0.00165",
      "percentile": "0.062"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5a95aa0198af75047d98fb72950642c89dab770f",
                    "status": "affected",
                    "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7bed4af0ced82948d660205efecd551ef8bc3912",
                    "status": "affected",
                    "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable\n\nmlx5_lag_get_dev_seq() will return error when the peer isn\u0027t in the LAG\nor when no device is marked as master. Result bad memory access and kernel\ncrash[1].\n\nHence, skip the peer when lookup fails.\n\nNote: In case there are peer flows, they are cleaned before LAG cleared\nthe master mark.\n\n[1]\nRIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core]\nCall Trace:\n \u003cTASK\u003e\n mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core]\n mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core]\n mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core]\n mlx5_devcom_send_event+0x7a/0x140 [mlx5_core]\n mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core]\n mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core]\n mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core]\n mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core]\n mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core]\n mlx5e_detach_netdev+0x96/0xf0 [mlx5_core]\n mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\n mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core]\n mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core]\n __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core]\n mlx5e_rep_remove+0x22/0x30 [mlx5_core]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xe8/0x1b0\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core]\n mlx5_unregister_device+0x54/0x80 [mlx5_core]\n mlx5_uninit_one+0x73/0x130 [mlx5_core]\n remove_one+0x78/0xe0 [mlx5_core]\n pci_device_remove+0x39/0xa0"
          }
        ],
        "id": "CVE-2026-72344",
        "lastModified": "2026-08-17T06:18:38.317",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:07.773",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5a95aa0198af75047d98fb72950642c89dab770f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7bed4af0ced82948d660205efecd551ef8bc3912"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:08:13+00:00",
      "cve": "CVE-2026-72344",
      "id": "CVE-2026-72344",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72344.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:29:48Z",
      "cve": "CVE-2026-72344",
      "id": "CVE-2026-72344",
      "initial_release_date": "2026-09-01T13:29:48Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72344",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72344.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.