Executive brief
A vulnerability exists in the Linux kernel's network bonding driver, which is used to combine multiple network interfaces into a single logical link for redundancy or increased throughput. An authorized local user with administrative network privileges could trigger a system crash (kernel oops) by attempting to perform operations on a non-existent network interface. This results in a local denial-of-service, potentially disrupting network connectivity and system availability.
Technical details
A NULL pointer dereference exists in 'drivers/net/bonding/bond_main.c' within the 'bond_do_ioctl()' function. The vulnerability occurs because the 'slave_dbg()' macro is called to log information about a slave device before verifying if the device pointer returned by '__dev_get_by_name()' is NULL. When the macro expands, it unconditionally dereferences the 'name' field of the potentially NULL pointer. A local attacker with 'CAP_NET_ADMIN' capabilities can trigger this by passing a non-existent interface name to bonding ioctls such as 'SIOCBONDENSLAVE' or 'SIOCBONDRELEASE'. The issue has been patched in multiple stable kernel branches by moving the debug call after the NULL check.
Affected products
- Linux Linux Kernel v5.2 to v6.9.x
Timeline
- 2026-06-01: disclosed: Initial patch submission by ZhaoJinming
- 2026-06-19: patched: Commits applied to stable kernel trees by Greg Kroah-Hartman
- 2026-07-01: advisory: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/1b7558c85493467b2ea20738866b822db6442034
- https://git.kernel.org/stable/c/66693957bacd1c9dae6188a7312d6be69a221f2d
- https://git.kernel.org/stable/c/a629418d463fb50d132a1aa063b0105857311e5f
- https://git.kernel.org/stable/c/a764b0e8317a863006e05732e1aefe821b9d8c2d
- https://git.kernel.org/stable/c/b02b2e3e876c18733b868a29064abd11cdbf8feb
- https://git.kernel.org/stable/c/b0878106ddc486375084145848ff255dedfff46a
- https://git.kernel.org/stable/c/bcb8fad90f27300add583a8371db504b766d95c7