CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-28

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error mlx5_mpesw_work() returned without calling complete() when mlx5_lag_get_devcom_comp() returned NULL. A caller that queued the work and waited on mpesww->comp would block indefinitely. Funnel the early-return path through a new "complete" label so the waiter is always woken.

Affected products

Linux kernel: 6.7 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/4d720c6c60e1852253b68aeee3044ebed5243adb
https://git.kernel.org/stable/c/68cdbe498da8475cfd49591954e3db8fc6582eda
https://git.kernel.org/stable/c/6a802de97a8bf8d5f1e4a048c67de9a8c2d2f9eb
https://git.kernel.org/stable/c/d4b85f9a668b9c44216bb78daf4ec1a915cc92d1

Get alerted when CVE-2026-80667 or the next vulnerability affects your stack