CVE-2026-98807: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-7rpx-hg5j-v22f
Share
Published
Advisory Summary

CVE-2026-98807 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98807 at a Glance

CVE Identifier CVE-2026-98807
GHSA Identifier GHSA-7rpx-hg5j-v22f
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98807

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98807, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions check for LAG masters (which includes both bonding and team devices) but only call bonding-specific APIs. When processing team device events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on team_port structures causes KASAN to detect an out-of-bounds memory access since team_port is smaller than bond slave. Fix this by wrapping the bond-specific API calls with a check for bonding devices. This allows the function to still process LAG events for both bonding and teams but only calls bond-specific functions when dealing with actual bonding devices. For mlx5_handle_changeinfodata_event(), keep the explicit bond check as mlx5 doesn't handle state information for team ports anyway. Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6: - Bonding: PASS (no regressions) - Team device: PASS (no KASAN errors)

References

NVD — CVE-2026-98807 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98807
git.kernel.org/stable/c/04c824940d... WEB
https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35
git.kernel.org/stable/c/16ca0e79f3... WEB
https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47
git.kernel.org/stable/c/3a6e67ff26... WEB
https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461
git.kernel.org/stable/c/8117cbc504... WEB
https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb

Frequently Asked Questions

What is CVE-2026-98807?
CVE-2026-98807 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98807?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98807?
CVE-2026-98807 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98807?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7rpx-hg5j-v22f",
  "modified" : "2026-10-18T18:32:04Z",
  "published" : "2026-10-18T18:32:04Z",
  "aliases" : [ "CVE-2026-98807" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call bonding-specific APIs. When processing team device\nevents, calling bond_slave_get_rcu() and bond_is_slave_inactive() on\nteam_port structures causes KASAN to detect an out-of-bounds memory access\nsince team_port is smaller than bond slave.\n\nFix this by wrapping the bond-specific API calls with a check for bonding\ndevices. This allows the function to still process LAG events for both\nbonding and teams but only calls bond-specific functions when dealing with\nactual bonding devices.\n\nFor mlx5_handle_changeinfodata_event(), keep the explicit bond check as\nmlx5 doesn't handle state information for team ports anyway.\n\nTested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:\n- Bonding: PASS (no regressions)\n- Team device: PASS (no KASAN errors)",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98807"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/04c824940d52871c49866a4ac67b504146f7cf35"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/16ca0e79f31ea810346a79dda545ba344ede1d47"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3a6e67ff267af2053a793825c3b7844741fed461"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8117cbc504cb01980258d8a8c9be8f57cf0aaceb"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:34Z"
  }
}