Linux Kernel up to 7.1.4/7.2-rc2 LAG net/mlx5 mlx5_lag_create_single_fdb off-by-one

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.4/7.2-rc2. It has been classified as very critical. Affected by this vulnerability is the function mlx5_lag_create_single_fdb of the file net/mlx5 of the component LAG. The manipulation leads to off-by-one. This vulnerability is documented as CVE-2026-72345. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.4/7.2-rc2 and classified as very critical. This issue affects the function mlx5_lag_create_single_fdb of the file net/mlx5 of the component LAG. The manipulation with an unknown input leads to a off-by-one vulnerability. Using CWE to declare the problem leads to CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-72345 since 08/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc3 eliminates this vulnerability. Applying the patch 40cc06bf71476932e5d139fa326dcd0372766e16/0f0e4ae6975c773f7854fc48932a267f6c79088f is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.2-rc1
• 7.2-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion