Linux Kernel CVE-2026-74726

Exploitation requires all of the following: (1) Linux kernel version 2.6.24 through an unpatched stable release in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, or 7.2 branches; (2) the bonding kernel module loaded and at least one bonding interface explicitly configured in ALB mode (bonding mode=6 or mode=balance-alb) - ALB is not the default bonding mode and requires deliberate administrator configuration; (3) local system access with credentials sufficient to hold CVSS PR:L - in practice, sending RTM_DELLINK to remove a bonding slave requires CAP_NET_ADMIN, which constrains exploitation to privileged local users or processes; and (4) successful timing of a slave removal event against the monitor's RCU-to-RTNL transition window. The vulnerability cannot be triggered remotely, does not affect systems without ALB bonding active, and does not affect other bonding modes. The promiscuous mode underflow variant additionally requires a failover slave to be present at race time.

The CVSS 3.1 vector AV:L/AC:L/PR:L places this squarely in the local, low-privilege attack category, substantially limiting the exploitable population to authenticated local users or processes on the host. The provided AC:L may be optimistic: reliably triggering the race requires coordinating a bonding slave removal event with the precise moment bond_alb_monitor() holds primary_is_promisc under RCU but has not yet acquired RTNL - a narrow, timing-sensitive window that in practice behaves more like AC:H conditions. The A:H rating is well-supported by the documented kernel panic trace and KASAN output in the commit. The C:H rating reflects the promiscuous mode persistence scenario, where a network interface pinned in IFF_PROMISC silently captures all traffic visible on that network segment - a meaningful confidentiality risk in shared hosting, cloud, or multi-tenant environments where physical or virtual network segments carry cross-tenant traffic. EPSS at 0.22% (13th percentile) and absence from CISA KEV both confirm no meaningful automated or opportunistic exploitation activity observed at time of analysis. SSVC assessment: exploitation is theoretical (no POC code), not automatable (requires local access and timing coordination), and technical impact is partial for both availability (triggered crash) and confidentiality (passive traffic exposure). This is a legitimate scheduled patching priority for teams managing bonded Linux network infrastructure, particularly those in multi-tenant or sensitive traffic environments, but does not warrant emergency response given the local-access prerequisite and very low EPSS.

A local user with low privileges on a system running an affected kernel with at least one ALB-mode bonding interface triggers slave removal via a CAP_NET_ADMIN-gated RTM_DELLINK netlink message. This races with the bond_alb_monitor() workqueue cycle at the moment it has read primary_is_promisc under RCU but not yet reacquired RTNL. If the race window is hit with no failover slave available, the monitor dereferences NULL curr_active_slave, producing a kernel panic and system crash. In the failover variant, the monitor instead issues a spurious promiscuity decrement on the new slave, permanently setting IFF_PROMISC and enabling passive capture of all traffic on that network segment without further attacker action.