Executive brief
A networking driver component in the Linux kernel has an off-by-one error in its error recovery logic when setting up Link Aggregation Group (LAG) forwarding rules. During failure recovery, the code attempts to undo installation of network rules starting from an already-failed index, which can operate on uninitialized memory or attempt to undo rules that were never successfully installed, potentially causing data corruption, kernel crashes, or denial of service.
Technical details
This is an off-by-one logic error in the mlx5_lag_create_single_fdb() function in the Mellanox MLX5 ethernet driver. When rule installation fails at index i, the reverse cleanup loop incorrectly starts from i instead of i-1, causing it to attempt rollback of the failed index itself. This can either operate on uninitialized state or double-tear-down a rule that the add_one path already self-rolled-back. The vulnerability is triggered during normal error recovery paths when LAG forwarding database configuration fails; no special authentication or user interaction is required. An attacker with the ability to trigger LAG configuration failures (or a malfunctioning network setup) could cause kernel memory corruption or system crashes. The fix is a one-line change to start the rollback loop from i-1 instead of i, ensuring only successfully-installed entries are undone.
Affected products
- Linux Linux kernel multiple versions (affected by commit ddbb5ddc43ad)
Timeline
- 2026-08-15: disclosed
- 2026-06-30: patched: Fix committed upstream
- 2026-07-03: patched: Fix merged by Paolo Abeni