Look up another CVE · open CVE-2026-23171 in the interactive tracker
CVE-2026-23171
bonding: fix use-after-free due to enslave fail after slave array update
Published 2026-02-14 (8 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-23171 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6295-1 · 2026-05-23 · text | 6.12.90-1 | Update the kernel and reboot. DSA-6295-1 shipped the fix on 2026-05-23, in 6.12.90-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.18.9-1 | Update the kernel and reboot. Fixed in 6.18.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.18.9-1 | Update the kernel and reboot. Fixed in 6.18.9-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/bonding/bond_main.c
- What this is
- BONDING DRIVERMAINTAINERS section matched on drivers/net/bonding/ · netdev@vger.kernel.org · Maintained
- Kernel module
- bonding
Check it on the machine
grep -w CONFIG_BONDING /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w bondingPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_BONDING
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-02-14 (8 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.15 | 6.6.140 | 172dcb67dd35 |
| 5.15 | 6.12.90 | 2889d92c5f72 |
| 5.15 | 6.18.9 | bd25b092a06a |
| 5.15 | 6.19 | e9acda52fd2e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6295-1 | 2026-05-23 | trixie 6.12.90-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerability is triggered via local netlink operations (ip link set ... master) which requires CAP_NET_ADMIN. This is a local attack vector through syscalls/ioctls, not remotely reachable via network packets.
- AC:LAttack complexity, low
- The attacker controls both sides of the race — they trigger the enslave operation and the packet transmit concurrently. The commit confirms it is "very easy to reproduce" and crashes "almost immediately." The attacker creates and controls the race conditions.
- PR:LPrivileges required, low
- Requires CAP_NET_ADMIN, but this capability is obtainable by an unprivileged local user through user namespaces (unshare -Urn). Bond interfaces, dummy devices, and XDP programs can all be created within a user/network namespace.
- UI:NUser interaction, none
- No user interaction is required. The attacker can set up the bond device, XDP program, dummy slave, and trigger the race entirely on their own.
- S:UScope, unchanged
- The vulnerability affects the kernel within its own security scope. There is no crossing of security boundaries such as VM escape or IOMMU bypass.
- C:HConfidentiality impact, high
- This is a use-after-free where the freed slave struct is accessed through the transmit array. An attacker can reallocate the freed memory with controlled content via heap spray, potentially reading arbitrary kernel memory through the slave struct's pointer fields.
- I:HIntegrity impact, high
- The use-after-free gives the attacker control over the freed slave object's contents through heap spraying. The Tx path dereferences pointers from the slave struct (e.g., slave->dev), enabling arbitrary write primitives and potential code execution.
- A:HAvailability impact, high
- The vulnerability causes an immediate kernel oops/crash as demonstrated in the commit message, with access to wild memory addresses. This is trivially reproducible for a denial of service.