Riskcovery

CVE-2026-72345

net/mlx5: LAG, Fix off-by-one in single-FDB error rollback

State
Published
Severity
7.8 High
Published
Aug 15, 2026
Updated
Oct 16, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: LAG, Fix off-by-one in single-FDB error rollback

On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back.

Start the rollback from i - 1 so only successfully-installed entries are undone.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ddbb5ddc43ad000a984149db5af1133433938404 to before 0be672071d6e8c4d3be6a8f796d8e47198763770Affected
  • ddbb5ddc43ad000a984149db5af1133433938404 to before 40cc06bf71476932e5d139fa326dcd0372766e16Affected
  • ddbb5ddc43ad000a984149db5af1133433938404 to before 0f0e4ae6975c773f7854fc48932a267f6c79088fAffected
  • 8330e9f0214c0f0b73c57b3f3f619b64c8035029Affected
  • 6.12.113 to before 6.13Affected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.