CVE-2026-72344

Received Received - Intake

Memory Corruption in Linux Kernel mlx5_core Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash[1]. Hence, skip the peer when lookup fails. Note: In case there are peer flows, they are cleaned before LAG cleared the master mark. [1] RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core] Call Trace: <TASK> mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core] mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core] mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core] mlx5_devcom_send_event+0x7a/0x140 [mlx5_core] mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core] mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core] mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core] mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core] mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core] mlx5e_detach_netdev+0x96/0xf0 [mlx5_core] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core] __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core] mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core] mlx5e_rep_remove+0x22/0x30 [mlx5_core] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xe8/0x1b0 device_del+0x159/0x3c0 mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core] mlx5_unregister_device+0x54/0x80 [mlx5_core] mlx5_uninit_one+0x73/0x130 [mlx5_core] remove_one+0x78/0xe0 [mlx5_core] pci_device_remove+0x39/0xa0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72344

EUVD

EUVD-2026-59243

Affected Vendors & Products

Vendor	Product	Version / Range
mlx	mlx5_core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the mlx5e driver for Mellanox ConnectX network cards. It occurs when the system tries to clean up peer flows in a Link Aggregation Group (LAG) but fails to get the LAG sequence number. This leads to a bad memory access and kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's mlx5_core driver and involves issues with LAG (Link Aggregation Group) peer flow cleanup. Detection requires checking kernel logs for crashes or errors related to mlx5_core, particularly during network interface changes or driver unloading. Commands like dmesg | grep mlx5_core or journalctl -k | grep mlx5_core may help identify related errors.

Impact Analysis

If exploited, this vulnerability could cause a system crash, leading to denial of service. It affects systems using Mellanox ConnectX network cards with LAG configurations and traffic control (TC) offloading enabled.

Compliance Impact

This vulnerability causes kernel crashes due to bad memory access in the Linux kernel's mlx5e driver, which could lead to denial of service conditions. Such instability may disrupt data processing and network operations, potentially impacting compliance with standards like GDPR (data availability) and HIPAA (system reliability).

Mitigation Strategies

Apply the latest kernel updates or patches that address this specific issue in the mlx5_core driver. If using Mellanox hardware, check for vendor-provided firmware or driver updates. Avoid unloading or resetting network drivers until the patch is applied to prevent potential kernel crashes.

Hi! I’m here to help you understand CVE-2026-72344. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70