Executive brief
A vulnerability exists in the Linux kernel's network bonding driver, which allows multiple network interfaces to act as one for redundancy or performance. When certain types of virtual network tunnels (like GRE) are combined into a bond, the system can confuse different types of internal data structures. This confusion can lead to system crashes (denial of service) or potentially allow an attacker with local access to compromise the system's stability and security.
Technical details
A type confusion vulnerability exists in bond_setup_by_slave() within the Linux kernel bonding driver. When a non-Ethernet device (such as a GRE tunnel) is enslaved to a bond, the driver directly copies the slave's header_ops to the bond device. Subsequent calls to dev_hard_header() on the bond device invoke slave-specific functions like ipgre_header(), which use netdev_priv() to access private data. Because netdev_priv() returns the bond's private data (struct bonding) instead of the expected tunnel structure (e.g., struct ip_tunnel), the kernel reads garbage values, leading to a BUG at net/core/skbuff.c. This can be triggered by a local user with sufficient privileges to configure network interfaces. Patches have been released for multiple stable kernel branches to introduce wrapper functions that correctly delegate header operations to the active slave device.
Affected products
- Linux Linux Kernel versions from (including) 2.6.24 up to (excluding) 6.12.78; versions from (including) 6.13 up to (excluding) 6.18.19; versions from (including) 6.19 up to (excluding) 6.19.9; 7.0-rc1; 7.0-rc2; 7.0-rc3
Timeline
- 2026-03-06: other: Patch submitted by Jiayuan Chen
- 2026-05-08: disclosed: CVE published
- 2026-05-20: advisory: NIST initial analysis