Junglewise Threat Intelligence

CVE-2026-23099: Linux Kernel out-of-bounds read in bonding driver 802.3ad mode

CVE-2026-23099 · Severity: high · CVSS 7.1 · Published 2026-02-04

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability was discovered in the Linux kernel's network bonding driver, which allows multiple network interfaces to be combined into a single logical interface. When using a specific high-speed bonding mode (802.3ad) with non-Ethernet devices, the system may attempt to access memory outside of intended boundaries. This could lead to system instability, crashes, or potential unauthorized access to sensitive information stored in system memory.

Technical details

A global out-of-bounds read vulnerability exists in the Linux kernel bonding driver (drivers/net/bonding/bond_main.c). The root cause is that BOND_MODE_8023AD (Link Aggregation Control Protocol) was not restricted to Ethernet devices (ARPHRD_ETHER), despite LACPDU multicast addresses being specifically designed for Ethernet. When a non-Ethernet device is enslaved in 802.3ad mode, the kernel attempts to copy a 16-byte LACPDU multicast address into hardware address lists that may not be appropriately sized for non-Ethernet types. This was detected by syzbot as a KASAN global-out-of-bounds error in __hw_addr_create. A local attacker with sufficient privileges to configure network interfaces could exploit this to read sensitive kernel memory or cause a denial of service (system crash). The fix introduces a check in bond_enslave() to ensure 802.3ad mode is only used with Ethernet devices.

Affected products

  • Linux Linux 2.6.24 to 6.13.x

Timeline

  • 2026-01-13: patched: Initial patch submitted by Eric Dumazet
  • 2026-02-04: disclosed: CVE-2026-23099 published

References