Executive brief
A vulnerability in the Linux kernel's network bonding driver could allow a local user to cause a system warning or kernel instability. The issue occurs when specific network traffic distribution policies are changed while high-performance packet processing (XDP) is active. This can lead to errors when the system tries to shut down or reconfigure the network interface, potentially impacting system availability.
Technical details
A logic error exists in the Linux kernel bonding driver where bond_option_xmit_hash_policy_set() does not validate compatibility with loaded XDP programs. Specifically, for 802.3ad and balance-xor modes, the 'vlan+srcmac' policy is incompatible with XDP because hardware offloading often removes the 802.1q payload. An attacker with local privileges can load a compatible XDP program and then switch the policy to 'vlan+srcmac'. This creates an inconsistent state where bond_xdp_check() returns false while a program is still attached. When the bond interface is later destroyed, dev_xdp_uninstall() fails to remove the program due to the check, triggering a WARN_ON and potentially leaving the system in an unstable state. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.15 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-25: advisory: CVE-2026-23310 published by NVD
- 2026-03-12: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/0ace8027e41f6f094ef6c1aca42d2ed6cd7af54e
- https://git.kernel.org/stable/c/479d589b40b836442bbdadc3fdb37f001bb67f26
- https://git.kernel.org/stable/c/5c262bd0e39320a6d6c8277cb8349ce21c01b8c1
- https://git.kernel.org/stable/c/d36ad7e126c6a0c5f699583309ccc37e3a3263ea
- https://git.kernel.org/stable/c/e85fa809e507b9d8eff4840888b8c727e4e8448c