Junglewise Threat Intelligence

CVE-2026-43441: Linux Kernel NULL pointer dereference in bonding driver

CVE-2026-43441 · Severity: high · CVSS 7.5 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network bonding driver can cause a system crash (denial of service). This occurs when a system is configured to disable IPv6 but still receives specific IPv6 network traffic on a bonded interface. An attacker could potentially trigger this crash remotely by sending malicious network packets, leading to a complete loss of system availability.

Technical details

A NULL pointer dereference exists in the Linux kernel bonding driver's handling of IPv6 Neighbor Advertisement (NA) and Neighbor Solicitation (NS) packets. When the kernel is booted with 'ipv6.disable=1', the Neighbor Discovery table (nd_tbl) is never initialized. However, if bonding ARP/NS validation is enabled, incoming IPv6 packets can still reach bond_validate_na(), which eventually calls __ipv6_chk_addr_and_flags(), leading to a crash. The vulnerability is fixed by adding a check for ipv6_mod_enabled() in bond_rcv_validate() before processing IPv6 packets. The issue affects multiple stable branches and has been patched in versions including 6.1.167, 6.6.130, 6.12.78, 6.18.19, and 6.19.9.

Affected products

  • Linux Linux Kernel 5.18 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3

Timeline

  • 2026-03-11: patched: Mainline patch committed by Jakub Kicinski
  • 2026-05-08: advisory: CVE-2026-43441 published

References

Related threats