Executive brief
The Linux kernel's bonding driver has a race condition in its active-backup/load-balancing monitor function that can crash the system or corrupt network interface state. When the system switches active network interfaces during monitoring, stale state data can cause a null pointer dereference (kernel panic) or incorrectly persist promiscuous mode on the wrong interface, disrupting normal network traffic filtering.
Technical details
A race condition exists in the Linux kernel's bonding driver (drivers/net/bonding/bond_alb.c) in the bond_alb_monitor() function, which runs periodically to manage active-backup failover. The function reads the primary_is_promisc flag and curr_active_slave pointer under RCU lock, then releases RCU and acquires RTNL lock via rtnl_trylock(). During this window, the active slave can change (via RTM_DELLINK → __bond_release_one() → bond_alb_handle_active_change()), which clears the stale flags under RTNL. When bond_alb_monitor() later acts on its pre-lock decision, it may dereference a now-NULL curr_active_slave (causing a null-pointer dereference and kernel panic) or decrement promiscuity on the wrong interface (causing a counter underflow that pins IFF_PROMISC). The fix re-checks primary_is_promisc and curr_active_slave after acquiring RTNL, mirroring the pattern already used in bond_miimon_commit() and bond_ab_arp_commit().
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed