CVE-2026-43013 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: lag: Check for LAG device before creating debugfs __mlx5_lag_dev_add_mdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5_ldev_add_debugfs() even when there is no valid LAG context. mlx5_ldev_add_debugfs() blindly created the debugfs directory and attributes. This exposed interfaces (like the members file) that rely on a valid ldev pointer, leading to potential NULL pointer dereferences if accessed when ldev is NULL. Add a check to verify that mlx5_lag_dev(dev) returns a valid pointer before attempting to create the debugfs entries.
A vulnerability exists in the Linux kernel's handling of Link Aggregation Group (LAG) devices within the net/mlx5 component. The issue arises because the function responsible for adding a LAG device to the debug filesystem can incorrectly indicate success, even after encountering an error. This flaw allows the initialization process to proceed without a valid LAG context, leading to the creation of debugfs entries that could be accessed with a null pointer. Such access could cause null pointer dereferences, potentially leading to system instability or crashes.
Users can update to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/7129632cab3e4d23510b21930aa73b8d97a859f5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/89c65f2fcd8801365b410f40a427cbcd7f4c28e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a3db46d5f4df92630a96f7bc77b60e75c2353e06 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bf16bca6653679d8a514d6c1c5a2c67065033f14 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c53cf44588a93000f71817a6bb87a66353c48dee | kernel.org | Patch |
| https://git.kernel.org/stable/c/cfa774e6c920c81e700327bf10db8cb50d5db456 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.19, < 6.1.168 >= 6.2, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |