Executive brief
A vulnerability in the Linux kernel's network bonding driver could allow a remote attacker to cause a system hang or crash. The issue occurs when processing network headers in specific nested bonding configurations, leading to an infinite loop. This results in a denial-of-service (DoS) condition, impacting the availability of the affected server or network appliance.
Technical details
A vulnerability exists in the Linux kernel bonding driver where bond_header_parse() can enter an infinite loop. This occurs when a stack of two or more bonding devices is configured because the skb->dev pointer consistently references the top of the hierarchy during header parsing, preventing the recursion from reaching a leaf node. The fix introduces a new 'const struct net_device *dev' parameter to the (struct header_ops)->parse() method to ensure recursion is bounded and correctly identifies the intended device in the hierarchy. The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition).
Affected products
- Linux Linux Kernel 6.12.78, 6.18.19, 6.19.9, 7.0-rc1 through 7.0-rc4
Timeline
- 2026-03-15: other: Vulnerability fixed in kernel source
- 2026-04-03: disclosed: Initial publication of CVE-2026-23451
- 2026-05-20: advisory: NVD advisory updated with CVSS and CWE details