CVE-2026-31546: Linux Kernel NULL pointer dereference in bonding debugfs

CVE-2026-31546 · Severity: medium · CVSS 5.5 · Published 2026-04-24

A vulnerability exists in the Linux kernel's network bonding driver, which is used to combine multiple network interfaces for redundancy or increased throughput. An attacker with local access to the system could trigger a kernel crash (Blue Screen equivalent) by accessing specific diagnostic files. This results in a denial-of-service, potentially disrupting network operations and industrial controllers that rely on this software.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2026-31546 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-31546 being exploited in the wild.
How severe is CVE-2026-31546?
Medium severity, with a CVSS score of 5.5, published 24 April 2026.
Which products and versions are affected?
Linux Kernel Fixed in 6.1.x, 6.6.x, 6.7.x, 6.8.x and others via stable backports; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6.
Is there a fix for CVE-2026-31546?
A patch was published on 2026-03-25: Commits merged into stable trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31546 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-31546?
Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference exists in the bond_debug_rlb_hash_show function within drivers/net/bonding/bond_debugfs.c. The vulnerability occurs because the Receive Load Balancing (RLB) implementation intentionally keeps hash table entries with a NULL slave pointer when no replacement is available, but the debugfs iteration logic fails to validate this pointer before dereferencing it. A local user with access to the bonding debugfs interface can trigger a kernel panic by reading the affected file. The issue has been resolved by adding a NULL check that prints '(none)' when no slave is assigned.

Affected products

  • Linux Linux Kernel Fixed in 6.1.x, 6.6.x, 6.7.x, 6.8.x and others via stable backports
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-16: disclosed: Initial patch authored
  • 2026-03-25: patched: Commits merged into stable trees
  • 2026-04-24: advisory: CVE published
  • 2026-07-14: other: Siemens industrial products confirmed affected

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.