Executive brief
A synchronization issue was identified in the Linux kernel's network bonding driver, specifically within the IEEE 802.3ad (LACP) implementation. This flaw could lead to a system crash or unpredictable networking behavior when the system is managing multiple network interfaces simultaneously. The issue primarily affects system stability and the reliability of high-availability network connections.
Technical details
A data race was discovered by syzbot in the Linux kernel bonding driver's 802.3ad implementation. The vulnerability exists between bond_3ad_get_active_agg_info and bond_3ad_state_machine_handler due to improper Read-Copy-Update (RCU) rules for the port->aggregator pointer. Specifically, the code lacked the necessary __rcu qualifier and proper RCU API calls (like rcu_dereference) when accessing the aggregator structure across different threads. This concurrency issue can result in use-after-free scenarios or null pointer dereferences during active aggregator changes or netlink-triggered info requests. The fix involves implementing proper RCU primitives to ensure thread-safe access to the aggregator state.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.8, 6.9, 7.0, 7.1
Timeline
- 2026-04-28: disclosed: Initial patch submitted by Eric Dumazet
- 2026-05-23: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-06-24: advisory: CVE-2026-52975 published
References
- https://git.kernel.org/stable/c/3b7265b3a82f40d2357c4004b26eb794a095b186
- https://git.kernel.org/stable/c/78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d
- https://git.kernel.org/stable/c/ba2272be04f0cb1e74e1e355ff32ef95df280731
- https://git.kernel.org/stable/c/c169c5837525ad842df6a542facf52b6f866a519
- https://git.kernel.org/stable/c/c4f050ce06c56cfb5993268af4a5cb66ed1cd04e