EUVD-2026-64413
GHSA-33v4-fjq4-gjwg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Race condition requires precise timing between RCU release and RTNL acquisition, warranting AC:H over the provided AC:L; PR:L reflects CAP_NET_ADMIN requirement for RTM_DELLINK.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC.
Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception
Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.
AnalysisAI
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Linux kernel version 2.6.24 through an unpatched stable release in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, or 7.2 branches; (2) the bonding kernel module loaded and at least one bonding interface explicitly configured in ALB mode (bonding mode=6 or mode=balance-alb) - ALB is not the default bonding mode and requires deliberate administrator configuration; (3) local system access with credentials sufficient to hold CVSS PR:L - in practice, sending RTM_DELLINK to remove a bonding slave requires CAP_NET_ADMIN, which constrains exploitation to privileged local users or processes; and (4) successful timing of a slave removal event against the monitor's RCU-to-RTNL transition window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L places this squarely in the local, low-privilege attack category, substantially limiting the exploitable population to authenticated local users or processes on the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with low privileges on a system running an affected kernel with at least one ALB-mode bonding interface triggers slave removal via a CAP_NET_ADMIN-gated RTM_DELLINK netlink message. This races with the bond_alb_monitor() workqueue cycle at the moment it has read primary_is_promisc under RCU but not yet reacquired RTNL. … |
| Remediation | Upgrade to a patched stable kernel release: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2 as appropriate for the deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Linux systems to identify those running with ALB mode network bonding using 'cat /proc/net/bonding/*'; document affected kernel versions from 2.6.24 through unpatched 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2.x. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers fo
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud meta
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, crea
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today