CVE-2026-43013

A flaw was found in the Linux kernel's net/mlx5 driver. An error in the __mlx5_lag_dev_add_mdev() function can lead to the creation of debugfs entries without a valid LAG (Link Aggregation Group) context. This exposes interfaces that rely on a valid pointer, potentially leading to a NULL pointer dereference if accessed. Such a dereference could result in a system crash, causing a denial of service (DoS).

This Moderate impact flaw in the Linux kernel's net/mlx5 driver can lead to a denial of service. The vulnerability occurs when debugfs entries are created without a valid Link Aggregation Group (LAG) context, potentially causing a NULL pointer dereference and system crash. This affects Red Hat Enterprise Linux systems utilizing Mellanox network adapters and the mlx5 driver, particularly in configurations involving LAG.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the mlx5_core kernel module is not actively used, it can be blacklisted to prevent the vulnerable code from being loaded. Create a file /etc/modprobe.d/blacklist-mlx5.conf with the content blacklist mlx5_core. Regenerate the initramfs and reboot the system for the changes to take effect. This action will disable all functionality provided by the mlx5 driver, which may affect network devices relying on it.