CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: lag: Check for LAG device before creating debugfs
mlx5lagdevaddmdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initialization flow proceeds to call mlx5ldevadddebugfs() even when there is no valid LAG context.
mlx5ldevadddebugfs() blindly created the debugfs directory and attributes. This exposed interfaces (like the members file) that rely on a valid ldev pointer, leading to potential NULL pointer dereferences if accessed when ldev is NULL.
Add a check to verify that mlx5lagdev(dev) returns a valid pointer before attempting to create the debugfs entries.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43013?
CVE-2026-43013 is classified as a medium severity vulnerability in the Linux kernel.
How can I fix CVE-2026-43013?
To fix CVE-2026-43013, update your Linux kernel to the latest version that includes the patch addressing this vulnerability.
What area of the system does CVE-2026-43013 affect?
CVE-2026-43013 affects the LAG (Link Aggregation Group) device functionality in the Linux kernel.
What can happen if CVE-2026-43013 is exploited?
If exploited, CVE-2026-43013 may result in improper handling of LAG devices, potentially causing system instability.
Where can I find more information about CVE-2026-43013?
More information about CVE-2026-43013 can typically be found in the release notes of the Linux kernel updates.