CVE-2026-72345 Linux CVE debrief

Who should care

Users and administrators of Linux systems that utilize the net/mlx5 module, especially in configurations where LAG (Link Aggregation) is employed, should be aware of this vulnerability and take necessary actions to mitigate potential risks. They should verify Linux kernel configurations, apply patches, and monitor for any unusual activity related to the net/mlx5 module to ensure system security and integrity.

Technical summary

The CVE-2026-72345 vulnerability is related to an off-by-one error in the mlx5_lag_create_single_fdb() function in the Linux kernel. This error occurs during the rollback process in case of failure at a certain index, potentially leading to the use of uninitialized state or double-tear-down of a rule that has already been rolled back by the add_one path. Affected Linux kernel users should verify their configurations and apply patches to prevent potential LAG-related issues.

Defensive priority

Linux kernel users should verify their configurations and apply patches to prevent potential LAG-related issues.

Recommended defensive actions

• Verify Linux kernel configurations for potential LAG-related issues.
• Apply patches to address the off-by-one error in mlx5_lag_create_single_fdb().
• Monitor for any unusual activity related to the net/mlx5 module.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE details an off-by-one error in the mlx5_lag_create_single_fdb() function, which could lead to operating on uninitialized state or double-tear-down of a rule. The issue has been resolved in the Linux kernel. Evidence is limited, so defenders should verify Linux kernel configurations and apply patches to prevent potential LAG-related issues. Users should also monitor for any unusual activity related to the net/mlx5 module.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.