CVE-2026-72344

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72344", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.920Z", "datePublished": "2026-08-15T05:55:49.751Z", "dateUpdated": "2026-08-17T05:43:03.143Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:03.143Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable\n\nmlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG\nor when no device is marked as master. Result bad memory access and kernel\ncrash[1].\n\nHence, skip the peer when lookup fails.\n\nNote: In case there are peer flows, they are cleaned before LAG cleared\nthe master mark.\n\n[1]\nRIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core]\nCall Trace:\n <TASK>\n mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core]\n mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core]\n mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core]\n mlx5_devcom_send_event+0x7a/0x140 [mlx5_core]\n mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core]\n mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core]\n mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core]\n mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core]\n mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core]\n mlx5e_detach_netdev+0x96/0xf0 [mlx5_core]\n mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\n mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core]\n mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core]\n __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core]\n mlx5e_rep_remove+0x22/0x30 [mlx5_core]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xe8/0x1b0\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core]\n mlx5_unregister_device+0x54/0x80 [mlx5_core]\n mlx5_uninit_one+0x73/0x130 [mlx5_core]\n remove_one+0x78/0xe0 [mlx5_core]\n pci_device_remove+0x39/0xa0"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in mlx5e TC eswitch peer-flow teardown (mlx5e_tc_clean_fdb_peer_flows/mlx5e_tc_del_fdb_peers_flow), reached via local TC netlink, netdev/LAG reconfiguration, or driver unload\u2014not from processing remote network packets.\nAC:L - On mlx5 LAG/merged-eswitch systems, a caller with CAP_NET_ADMIN can install TC flower rules that create peer flows, then trigger LAG unpair/teardown so mlx5_lag_get_dev_seq() fails and the unchecked negative index is used reliably.\nPR:L - Exploitation requires CAP_NET_ADMIN to install/delete mlx5e TC cls_flower offload rules and manipulate LAG/bond state; CAP_NET_ADMIN is obtainable in user/network namespaces and is not init-namespace root.\nUI:N - No victim interaction is required; the crash occurs during kernel-initiated peer-flow cleanup when LAG sequence lookup fails during eswitch unpair or mlx5e netdev/driver teardown.\nS:U - Impact is kernel memory corruption and crash on the host running mlx5; it does not cross a VM/hypervisor, IOMMU, or other security boundary into a separate authority.\nC:H - mlx5_lag_get_dev_seq() errors (e.g., -ENOENT) are used unchecked as peer_flows[]/flow->peer[] indices, causing out-of-bounds list operations that read and corrupt adjacent kernel memory beyond the flow structures.\nI:H - The faulting list_del(&flow->peer[peer_index]) and peer_flows[i] walks with a negative index perform out-of-bounds linked-list writes, corrupting kernel heap/metadata and enabling further memory control primitives.\nA:H - The fix commit documents a reproducible kernel crash (oops at mlx5e_tc_del_fdb_peers_flow) from this bad memory access during mlx5 eswitch/TC cleanup, causing complete loss of system availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"], "versions": [{"version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03", "lessThan": "5a95aa0198af75047d98fb72950642c89dab770f", "status": "affected", "versionType": "git"}, {"version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03", "lessThan": "7bed4af0ced82948d660205efecd551ef8bc3912", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5a95aa0198af75047d98fb72950642c89dab770f"}, {"url": "https://git.kernel.org/stable/c/7bed4af0ced82948d660205efecd551ef8bc3912"}], "title": "net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5a95aa0198af75047d98fb72950642c89dab770f", "status": "affected", "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03", "versionType": "git"}, {"lessThan": "7bed4af0ced82948d660205efecd551ef8bc3912", "status": "affected", "version": "971b28accc09436fe6a6d5afd667dcbfb3ed7e03", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable\n\nmlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG\nor when no device is marked as master. Result bad memory access and kernel\ncrash[1].\n\nHence, skip the peer when lookup fails.\n\nNote: In case there are peer flows, they are cleaned before LAG cleared\nthe master mark.\n\n[1]\nRIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core]\nCall Trace:\n <TASK>\n mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core]\n mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core]\n mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core]\n mlx5_devcom_send_event+0x7a/0x140 [mlx5_core]\n mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core]\n mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core]\n mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core]\n mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core]\n mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core]\n mlx5e_detach_netdev+0x96/0xf0 [mlx5_core]\n mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\n mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core]\n mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core]\n __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core]\n mlx5e_rep_remove+0x22/0x30 [mlx5_core]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xe8/0x1b0\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core]\n mlx5_unregister_device+0x54/0x80 [mlx5_core]\n mlx5_uninit_one+0x73/0x130 [mlx5_core]\n remove_one+0x78/0xe0 [mlx5_core]\n pci_device_remove+0x39/0xa0"}], "id": "CVE-2026-72344", "lastModified": "2026-08-17T06:18:38.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:07.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a95aa0198af75047d98fb72950642c89dab770f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7bed4af0ced82948d660205efecd551ef8bc3912"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable", "id": "2516515", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516515"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable\nmlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG\nor when no device is marked as master. Result bad memory access and kernel\ncrash[1].\nHence, skip the peer when lookup fails.\nNote: In case there are peer flows, they are cleaned before LAG cleared\nthe master mark.\n[1]\nRIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core]\nCall Trace:\n<TASK>\nmlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core]\nmlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core]\nmlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core]\nmlx5_devcom_send_event+0x7a/0x140 [mlx5_core]\nmlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core]\nmlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core]\nmlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core]\nmlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core]\nmlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core]\nmlx5e_detach_netdev+0x96/0xf0 [mlx5_core]\nmlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\nmlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core]\nmlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core]\n__esw_offloads_unload_rep+0x81/0xb0 [mlx5_core]\nmlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core]\nmlx5e_rep_remove+0x22/0x30 [mlx5_core]\ndevice_release_driver_internal+0x194/0x1f0\nbus_remove_device+0xe8/0x1b0\ndevice_del+0x159/0x3c0\nmlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core]\nmlx5_unregister_device+0x54/0x80 [mlx5_core]\nmlx5_uninit_one+0x73/0x130 [mlx5_core]\nremove_one+0x78/0xe0 [mlx5_core]\npci_device_remove+0x39/0xa0", "A flaw was found in the Linux kernel's net/mlx5e driver. When the mlx5_lag_get_dev_seq() function encounters an error, such as a peer not being in the Link Aggregation Group (LAG) or no master device being marked, the system attempts to clean up peer flows without proper validation. This improper handling can lead to bad memory access and a kernel crash, resulting in a denial of service."], "name": "CVE-2026-72344", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72344\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72344\nhttps://lore.kernel.org/linux-cve-announce/2026081510-CVE-2026-72344-6b98@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[971b28accc09436fe6a6d5afd667dcbfb3ed7e03,5a95aa0198af75047d98fb72950642c89dab770f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[971b28accc09436fe6a6d5afd667dcbfb3ed7e03,7bed4af0ced82948d660205efecd551ef8bc3912)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:45:03.372257+00:00", "updated": "2026-08-17T19:00:05.374760+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}