{"id":"AZL-108909","summary":"CVE-2026-98807 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call bonding-specific APIs. When processing team device\nevents, calling bond_slave_get_rcu() and bond_is_slave_inactive() on\nteam_port structures causes KASAN to detect an out-of-bounds memory access\nsince team_port is smaller than bond slave.\n\nFix this by wrapping the bond-specific API calls with a check for bonding\ndevices. This allows the function to still process LAG events for both\nbonding and teams but only calls bond-specific functions when dealing with\nactual bonding devices.\n\nFor mlx5_handle_changeinfodata_event(), keep the explicit bond check as\nmlx5 doesn't handle state information for team ports anyway.\n\nTested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:\n- Bonding: PASS (no regressions)\n- Team device: PASS (no KASAN errors)","modified":"2026-10-19T14:16:49.669279968Z","published":"2026-10-18T16:17:34Z","upstream":["CVE-2026-98807"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98807"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108909.json"}}],"schema_version":"1.9.0"}