Executive brief
A vulnerability in the Linux kernel's network bonding driver could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system fails to properly manage memory while adding a new network interface to a bonded group, particularly when using advanced networking features like XDP. This could lead to a complete system outage or a breach of data integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel bonding driver (drivers/net/bonding/bond_main.c). The root cause is an improper sequence of operations during the 'enslave' process: the slave array is updated before XDP setup is finalized. If XDP setup subsequently fails, the cleanup path frees the slave memory, but the bonding driver may have already started using that memory for transmission (Tx) operations. A local attacker can trigger this by repeatedly attempting to enslave a device while generating network traffic. The fix involves moving the slave array update to the end of the enslave process, after all potential failure points have passed.
Affected products
- Linux Linux kernel 5.15 to 6.18.9, 6.19-rc1 to 6.19-rc7
Timeline
- 2026-01-23: patched: Initial patch authored by Nikolay Aleksandrov
- 2026-02-14: disclosed: CVE-2026-23171 assigned and published
- 2026-05-17: advisory: Updated with stable release information