CVE-2026-72344

A flaw was found in the Linux kernel's net/mlx5e driver. When the mlx5_lag_get_dev_seq() function encounters an error, such as a peer not being in the Link Aggregation Group (LAG) or no master device being marked, the system attempts to clean up peer flows without proper validation. This improper handling can lead to bad memory access and a kernel crash, resulting in a denial of service.

This vulnerability is rated as having a Moderate impact because exploitation requires local system privileges to alter network configurations and results solely in a denial of service through an operating system crash. Red Hat Enterprise Linux releases are not vulnerable to this flaw, as the affected peer flow cleanup logic in the Mellanox network driver was introduced in a newer upstream kernel release and has not been incorporated into supported enterprise kernels. Where present, triggering this condition additionally requires specific hardware configurations involving Mellanox link aggregation and traffic control unpairing operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.