Junglewise Threat Intelligence

CVE-2026-31546: Linux Kernel NULL pointer dereference in bonding debugfs

CVE-2026-31546 · Severity: medium · CVSS 5.5 · Published 2026-04-24

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's network bonding driver, which is used to combine multiple network interfaces for redundancy or increased throughput. An attacker with local access to the system could trigger a kernel crash (Blue Screen equivalent) by accessing specific diagnostic files. This results in a denial-of-service, potentially disrupting network operations and industrial controllers that rely on this software.

Technical details

A NULL pointer dereference exists in the bond_debug_rlb_hash_show function within drivers/net/bonding/bond_debugfs.c. The vulnerability occurs because the Receive Load Balancing (RLB) implementation intentionally keeps hash table entries with a NULL slave pointer when no replacement is available, but the debugfs iteration logic fails to validate this pointer before dereferencing it. A local user with access to the bonding debugfs interface can trigger a kernel panic by reading the affected file. The issue has been resolved by adding a NULL check that prints '(none)' when no slave is assigned.

Affected products

  • Linux Linux Kernel Fixed in 6.1.x, 6.6.x, 6.7.x, 6.8.x and others via stable backports
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-16: disclosed: Initial patch authored
  • 2026-03-25: patched: Commits merged into stable trees
  • 2026-04-24: advisory: CVE published
  • 2026-07-14: other: Siemens industrial products confirmed affected

References

Related threats