CVE-2026-72345 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back.
Start the rollback from i - 1 so only successfully-installed entries are undone.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the mellanox mlx5 network driver in the linux kernel, specifically affecting the LAG (Link Aggregation Group) functionality with single FDB (Forwarding Database) operations. The issue manifests as an off-by-one error in the error rollback mechanism during the creation of single FDB entries, which can lead to unpredictable behavior and potential system instability. The vulnerability is classified under CWE-129 as an insufficient bounds checking and falls within the ATT&CK technique T1059.003 for execution through command-line interfaces.
The technical flaw occurs in the mlx5_lag_create_single_fdb() function where the cleanup loop for error handling starts from the failed index i instead of i-1. This incorrect starting point causes the system to attempt rollback operations on an uninitialized state or potentially double-tear-down rules that were already self-rolled-back by the add_one path during the same operation. The improper rollback sequence creates a race condition where memory or hardware resources may be accessed incorrectly, leading to potential kernel panics or data corruption. This type of error is particularly dangerous in network driver contexts as it can affect packet forwarding and network connectivity.
The operational impact of this vulnerability extends beyond simple memory management issues to potentially compromise the stability of network operations within systems using mlx5 devices. When the rollback mechanism fails due to the off-by-one error, it can cause the kernel to attempt invalid operations on hardware resources or memory structures that are either uninitialized or already freed. This failure mode could result in system crashes, network outages, or even privilege escalation scenarios if attackers can manipulate the conditions leading to this error path. The vulnerability affects systems where LAG functionality is enabled and single FDB entries are being created, which is common in high-performance networking environments.
Mitigation strategies for this vulnerability involve applying the kernel patch that corrects the rollback loop to start from i-1 instead of i, ensuring only successfully installed entries are undone during error recovery. System administrators should prioritize updating their linux kernel versions to include this fix, particularly in production environments where mlx5 network devices are deployed. Additional monitoring should be implemented to detect anomalous behavior in network operations that might indicate the vulnerability being triggered. The fix addresses the root cause by ensuring proper bounds checking in the error handling path, preventing access to uninitialized memory and redundant cleanup operations. Organizations using virtualized environments or containerized applications should verify their kernel versions and apply updates across all affected systems to maintain network stability and prevent potential exploitation of this type of kernel memory corruption vulnerability.