CVE-2026-72345net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ddbb5ddc43ad000a984149db5af1133433938404 before 0be672071d6e8c4d3be6a8f796d8e47198763770; from ddbb5ddc43ad000a984149db5af1133433938404 before 40cc06bf71476932e5d139fa326dcd0372766e16; from ddbb5ddc43ad000a984149db5af1133433938404 before 0f0e4ae6975c773f7854fc48932a267f6c79088f; 8330e9f0214c0f0b73c57b3f3f619b64c8035029; from 6.12.113 before 6.13 | CNA record |
References
- https://git.kernel.org/stable/c/0be672071d6e8c4d3be6a8f796d8e47198763770
- https://git.kernel.org/stable/c/40cc06bf71476932e5d139fa326dcd0372766e16
- https://git.kernel.org/stable/c/0f0e4ae6975c773f7854fc48932a267f6c79088f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.