CVE-2026-72345

A moderate severity flaw was found in the Linux kernel mlx5 LAG (Link Aggregation Group) driver. An off-by-one error in the error rollback path of mlx5_lag_create_single_fdb() causes the reverse cleanup loop, entered when single-FDB rule creation fails, to start at the failed index itself instead of the last successfully installed entry. The rollback can therefore operate on uninitialized state or tear down a rule that the add path already rolled back, which can result in use of uninitialized memory or a double free and ultimately a kernel panic or system crash (denial of service). Red Hat rated this flaw Moderate severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because triggering the vulnerable error path requires local privileged access and mlx5 LAG configuration on systems using mlx5-based network adapters, and only availability is impacted. This differs from the upstream CVEORG severity of Important (CVSS 7.8), which assumes high confidentiality and integrity impact that Red Hat's analysis does not find. The vulnerable code entered Red Hat Enterprise Linux through a later refactor of the mlx5 LAG logic: earlier streams (RHEL 7 and 8, and the RHEL 9.2, 9.4, 9.6, and 10.0 update streams) do not contain the vulnerable code and are not affected, and RHEL 6 is out of support scope. For the affected streams (RHEL 9.8, 9.9, 10.2, and 10.3, and Red Hat In-Vehicle OS 2.0 and 2.1 kernel components) the fix is deferred to a future update because the flaw is reachable only through a rarely exercised error path by a privileged local actor; the residual risk is denial of service on systems with mlx5 LAG configured.