Skip to main content

Linux Kernel CVE-2026-45970

| EUVDEUVD-2026-32254 HIGH
Use After Free (CWE-416)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-mc9g-h8jv-5cp3
Denial Of Service Linux Use After Free Memory Corruption Dell Canonical
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local access with low privileges
  2. Delivery
    Verify bond interface uses ALB mode (mode=6)
  3. Exploit
    Generate concurrent ARP RX traffic (e.g., ping flood)
  4. Install
    Rapidly cycle bond interface up/down via ip-link
  5. C2
    Race rlb_deinitialize() against softirq RX handler
  6. Execute
    rlb_arp_recv() dereferences freed rx_hashtbl
  7. Impact
    Kernel general protection fault / system panic

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target system must be running the Linux bonding driver configured in ALB mode (bonding mode=6 / balance-alb), which activates the RLB ARP interception subsystem containing the vulnerable rlb_arp_recv() function. This is a non-default bonding mode; LACP (mode=4) and active-backup (mode=1) are far more common in production and are not affected. The attacker must have local system access with sufficient privilege to toggle bond interface state - typically requiring CAP_NET_ADMIN, which is held by root and may be delegated to network administrators or granted within privileged containers. ARP traffic must be actively flowing through the bond interface during the up/down cycle to trigger the race (as demonstrated by the 'ping' process in the oops PID context). Remote unauthenticated exploitation is not possible (AV:L). The race condition is probabilistic, meaning exploitation is not instantaneous and requires repeated attempts. Exploitation is limited to: local access only, non-default ALB bonding configuration, active ARP RX traffic, and CAP_NET_ADMIN capability.
Impact

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores this as a high-severity local vulnerability with low attack complexity and low privilege requirements, implying that any local user capable of toggling bond interfaces could trigger the flaw. However, real-world risk is materially lower than the CVSS score suggests. EPSS at 0.02% (7th percentile) indicates virtually no observed exploitation probability at time of analysis, and there is no CISA KEV listing. The attack requires a specific, non-default networking configuration (bonding in ALB mode), CAP_NET_ADMIN or equivalent to manipulate interface state, and concurrent ARP RX traffic - a combination uncommon outside of network-heavy server environments. The C:H/I:H/A:H vector implies potential privilege escalation via kernel memory corruption, but the race-condition nature of the UAF makes deterministic exploitation for code execution unreliable; the most probable outcome is a kernel panic (DoS). The CVSS high-integrity and high-confidentiality ratings represent the theoretical ceiling of UAF exploitation, not the typical outcome. Primary operational risk is availability loss on servers using ALB bonding, such as high-availability Linux systems on Dell PowerEdge hardware or Canonical Ubuntu Server deployments.
Exploit ScenarioDerived

An attacker with a local shell account on a Linux server using bonded NICs in ALB mode runs a loop that repeatedly executes 'ip link set bond0 down && ip link set bond0 up' while ARP traffic flows through the interface (e.g., during a ping flood to a remote host). The rapid cycling races rlb_deinitialize() - which frees rx_hashtbl - against softirq-driven rlb_arp_recv() calls still processing incoming ARP packets, causing the kernel to dereference freed memory and trigger a general protection fault at rlb_arp_recv+0x505, as confirmed by the KASAN oops trace in the CVE description. The most likely outcome is an immediate kernel panic and system reboot, resulting in a denial of service.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Use-after-free in the Linux kernel bonding driver's Adaptive Load Balancing (ALB) subsystem allows a local low-privileged user to crash the kernel by racing rlb_arp_recv() against rlb_deinitialize() during rapid bond interface up/down cycling. Specifically, the RX handler continues to dereference rx_hashtbl entries after rlb_deinitialize() frees them, because recv_probe is set to NULL without first draining in-flight softirq handlers via synchronize_net(). Systems running bonded NICs in ALB mode (mode=6) on affected kernel versions - including Dell PowerEdge hardware and Canonical-distributed kernels - are at risk of kernel panic. No public exploit identified at time of analysis, and EPSS at 0.02% (7th percentile) confirms no observed mass exploitation.

RemediationAI

The primary remediation is to upgrade to a patched kernel: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4, or 7.0, depending on your stable branch. Upstream fix commits for each branch are available at git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626e (6.6), fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c (6.1), fef13c403be3fb685cb06419e6b3623106aab5ba (6.12), db5435b5342e3aaa4521d0f3ccfe94316b253ca1 (6.18), d31065526f160ee0244a719230aa069daca2bf4d (5.10), de7c097800f07f3c108185c7a38b53a530ba30ff (5.15), e6834a4c474697df23ab9948fd3577b26bf48656 (6.19), and f94a0de7b9f32745a14a1621c63087a092823587 (7.0). If immediate patching is not possible, switch the bonding configuration from ALB mode (mode=6 / mode=balance-alb) to a mode that does not use the RLB ARP interception path, such as LACP/802.3ad (mode=4); this avoids the vulnerable rlb_arp_recv() code path entirely but requires corresponding switch-side LACP configuration and may affect traffic distribution behavior. Additionally, restrict CAP_NET_ADMIN to only trusted administrators on multi-user systems (e.g., via user namespaces policy or removing net_admin from unprivileged containers) to reduce the attack surface, though this is a hardening measure rather than a fix. Canonical and other distribution vendors should be expected to backport these fixes to their supported kernel packages.

Affected VersionsENISA

Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c
Linux patch: 5.10.252
Linux patch: 6.1.165
Linux patch: 0
Linux patch: 6.19.4
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <fef13c403be3fb685cb06419e6b3623106aab5ba
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <db5435b5342e3aaa4521d0f3ccfe94316b253ca1
Linux patch: 7.0
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <c65cdf46ce340c9c00fbbaf84599d2daff43626e
Linux patch: 6.6.128
Linux patch: 6.12.75
Linux 3.0
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <de7c097800f07f3c108185c7a38b53a530ba30ff
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <d31065526f160ee0244a719230aa069daca2bf4d
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <f94a0de7b9f32745a14a1621c63087a092823587
Linux patch: 6.18.14
Linux 3aba891dde3842d89ad022237b99c1ed308040b0 <e6834a4c474697df23ab9948fd3577b26bf48656
Linux patch: 5.15.202

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux bonding driver supports multiple bonding modes; ALB (Adaptive Load Balancing, mode=6) includes a Receive Load Balancing (RLB) component that uses ARP interception to steer incoming traffic. The RLB subsystem maintains a hash table (rx_hashtbl) keyed on client MAC/IP pairs, populated and queried by rlb_arp_recv() in the softirq/IRQ network receive path (bond_handle_frame → __netif_receive_skb_core → rlb_arp_recv). During bond teardown, rlb_deinitialize() frees rx_hashtbl and sets recv_probe to NULL. The root cause is a classic time-of-check/time-of-use race: recv_probe is nulled without waiting for concurrent RX handlers still executing in softirq context to complete, resulting in rlb_arp_recv() dereferencing a freed rx_hashtbl entry. KASAN identifies this as a null-ptr-deref at offset 0xe8-0xef, consistent with accessing a freed bonding slave structure member. The CWE is not formally assigned in the NVD record, but the vulnerability is a textbook CWE-416 (Use After Free) with a secondary manifestation as CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The fix adds synchronize_net() after nulling recv_probe to ensure RCU-like completion of all in-flight RX handlers before the hash table is freed.

Know when Dell gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
May 30, 2026 - 11:22 NVD
7.8 (HIGH)
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: fix UAF in rlb_arp_recv during bond up/down

The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected by KASAN.

However, the root cause is that rlb_arp_recv() can still be accessed after setting recv_probe to NULL, which is actually a use-after-free (UAF) issue. That is the reason for using the referenced commit in the Fixes tag.

[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI [ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef] [ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary) [ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022 [ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding] [ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00 [ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206 [ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e [ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8 [ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8 [ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119 [ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810 [ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000 [ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0 [ 214.310347] Call Trace: [ 214.313070] <IRQ> [ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding] [ 214.320975] bond_handle_frame+0x166/0xb60 [bonding] [ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] [ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710 [ 214.339199] ? __pfx_arp_process+0x10/0x10 [ 214.343775] ? sched_balance_find_src_group+0x98/0x630 [ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10 [ 214.356513] ? arp_rcv+0x307/0x690 [ 214.360311] ? __pfx_arp_rcv+0x10/0x10 [ 214.364499] ? __lock_acquire+0x58c/0xbd0 [ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0 [ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 214.380743] ? lock_acquire+0x10b/0x140 [ 214.385026] process_backlog+0x3f1/0x13a0 [ 214.389502] ? process_backlog+0x3aa/0x13a0 [ 214.394174] __napi_poll.constprop.0+0x9f/0x370 [ 214.399233] net_rx_action+0x8c1/0xe60 [ 214.403423] ? __pfx_net_rx_action+0x10/0x10 [ 214.408193] ? lock_acquire.part.0+0xbd/0x260 [ 214.413058] ? sched_clock_cpu+0x6c/0x540 [ 214.417540] ? mark_held_locks+0x40/0x70 [ 214.421920] handle_softirqs+0x1fd/0x860 [ 214.426302] ? __pfx_handle_softirqs+0x10/0x10 [ 214.431264] ? __neigh_event_send+0x2d6/0xf50 [ 214.436131] do_softirq+0xb1/0xf0 [ 214.439830] </IRQ>

The issue is reproducible by repeatedly running ip link set bond0 up/down while receiving ARP messages, where rlb_arp_recv() can race with rlb_deinitialize() and dereference a freed rx_hashtbl entry.

Fix this by setting recv_probe to NULL and then calling synchronize_net() to wait for any concurrent RX processing to finish. This ensures that no RX handler can access rx_hashtbl after it is freed in bond_alb_deinitialize().

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel bonding driver affects systems using Adaptive Load Balancing mode (ALB/mode=6), allowing local users to trigger kernel panics and cause service outages. Organizations running Dell PowerEdge servers or Canonical-distributed Linux systems with bonded network interfaces face infrastructure availability risk. No patch is currently available, requiring immediate inventory and access control measures to mitigate exposure.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable ALB mode and migrate to alternative bonding modes (active-backup, balance-rr) if operationally viable; (2) restrict local system access to privileged administrators only; (3) implement kernel crash dump monitoring (kdump) with alerting for unexpected panic events; (4) apply kernel hardening (disable unprivileged BPF, restrict user namespaces) to reduce local exploitation surface; (5) monitor kernel vendor security advisories continuously and apply patches immediately upon release.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2016-9683 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2016-9682 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
CVE-2016-9684 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45970 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/366181 REF https://git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626e REF https://git.kernel.org/stable/c/d31065526f160ee0244a719230aa069daca2bf4d REF https://git.kernel.org/stable/c/db5435b5342e3aaa4521d0f3ccfe94316b253ca1 REF https://git.kernel.org/stable/c/de7c097800f07f3c108185c7a38b53a530ba30ff REF https://git.kernel.org/stable/c/e6834a4c474697df23ab9948fd3577b26bf48656 REF https://git.kernel.org/stable/c/f94a0de7b9f32745a14a1621c63087a092823587 REF https://git.kernel.org/stable/c/fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c REF https://git.kernel.org/stable/c/fef13c403be3fb685cb06419e6b3623106aab5ba

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy