CVE-2026-72345 (GCVE-0-2026-72345)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:43
VLAI
Title
net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ddbb5ddc43ad000a984149db5af1133433938404 , < 40cc06bf71476932e5d139fa326dcd0372766e16 (git)
Affected: ddbb5ddc43ad000a984149db5af1133433938404 , < 0f0e4ae6975c773f7854fc48932a267f6c79088f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/lag/shared_fdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40cc06bf71476932e5d139fa326dcd0372766e16",
              "status": "affected",
              "version": "ddbb5ddc43ad000a984149db5af1133433938404",
              "versionType": "git"
            },
            {
              "lessThan": "0f0e4ae6975c773f7854fc48932a267f6c79088f",
              "status": "affected",
              "version": "ddbb5ddc43ad000a984149db5af1133433938404",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/lag/shared_fdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: LAG, Fix off-by-one in single-FDB error rollback\n\nOn failure at index i, the reverse cleanup loop in\nmlx5_lag_create_single_fdb() starts from i, so the failed index\nitself is rolled back. That can operate on uninitialized state or\ndouble-tear-down a rule the add_one path already self-rolled-back.\n\nStart the rollback from i - 1 so only successfully-installed entries\nare undone."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable when mlx5 shared-FDB LAG setup runs via local admin paths (bond netdev notifier or devlink esw_multiport), not from remote packet handling on the mlx5 data path.\nAC:L - An attacker with CAP_NET_ADMIN can trigger bonding/MPESW setup and retry until mlx5_eswitch_offloads_single_fdb_add_one fails, reliably exercising the faulty rollback loop without uncontrollable timing or layout dependencies.\nPR:L - Exploitation requires configuring bonding or devlink eswitch parameters, which needs CAP_NET_ADMIN; per kernel CNA guidance this is Low because that capability is obtainable inside unprivileged user namespaces.\nUI:N - No end-user interaction is required beyond the attacker (or their privileged account) performing the LAG/shared-FDB configuration that reaches mlx5_lag_create_single_fdb().\nS:U - Impact is confined to kernel mlx5 eswitch/LAG state on the host; it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - The off-by-one rollback can tear down uninitialized or already-cleared eswitch flow/FDB state, causing memory corruption that can be leveraged for kernel information disclosure beyond a simple crash.\nI:H - Double teardown of master egress bounce rules and slave root FDB entries can corrupt mlx5 steering structures and heap metadata, enabling arbitrary kernel writes or control-flow hijacking.\nA:H - Incorrect rollback of failed single-FDB installs can panic the kernel or leave eswitch offload state inconsistent, causing oops, hang, or denial of service on affected Mellanox hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:04.347Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40cc06bf71476932e5d139fa326dcd0372766e16"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"
        }
      ],
      "title": "net/mlx5: LAG, Fix off-by-one in single-FDB error rollback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72345",
    "datePublished": "2026-08-15T05:55:50.427Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:43:04.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72345",
      "date": "2026-09-20",
      "epss": "0.00165",
      "percentile": "0.06199"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/lag/shared_fdb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "40cc06bf71476932e5d139fa326dcd0372766e16",
                    "status": "affected",
                    "version": "ddbb5ddc43ad000a984149db5af1133433938404",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f0e4ae6975c773f7854fc48932a267f6c79088f",
                    "status": "affected",
                    "version": "ddbb5ddc43ad000a984149db5af1133433938404",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/lag/shared_fdb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: LAG, Fix off-by-one in single-FDB error rollback\n\nOn failure at index i, the reverse cleanup loop in\nmlx5_lag_create_single_fdb() starts from i, so the failed index\nitself is rolled back. That can operate on uninitialized state or\ndouble-tear-down a rule the add_one path already self-rolled-back.\n\nStart the rollback from i - 1 so only successfully-installed entries\nare undone."
          }
        ],
        "id": "CVE-2026-72345",
        "lastModified": "2026-08-17T06:18:38.440",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:07.870",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40cc06bf71476932e5d139fa326dcd0372766e16"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T17:39:37+00:00",
      "cve": "CVE-2026-72345",
      "id": "CVE-2026-72345",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72345.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:29:46Z",
      "cve": "CVE-2026-72345",
      "id": "CVE-2026-72345",
      "initial_release_date": "2026-09-01T13:29:46Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72345",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72345.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.