Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-31419

net: bonding: fix use-after-free in bond_xmit_broadcast()

Affects the Linux kernel bonding driver in the listed branches, such as 5.10.94 to before 5.10.273 and 6.2.0 to before 6.6.143. Fixed in the listed later releases.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Fix
Fixed in 5.10.273, 5.15.224, 5.17, 6.1.184, 6.6.143, and 3 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 5.10.94 · fixed in 5.10.273; From 5.15.17 · fixed in 5.15.224; From 5.16.3 · fixed in 5.17

  • Linux Linux

    5.17

  • KernelLinux

    From 5.17.0 · fixed in 6.1.184; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.95; From 6.13.0 · fixed in 6.18.22; From 6.19.0 · fixed in 6.19.12

References 8

git.kernel.org

FAQ

Questions about CVE-2026-31419

What does this mean?

When a bond's slave interface is added or removed at the same time as a broadcast transmit, the slave list changes during the transmit walk. The original packet buffer is then consumed and freed twice, causing a use-after-free in kernel memory that can crash the system.Source: git.kernel.org

Am I affected, and how do I check?

The listed Linux kernel ranges are affected: 5.10.94 to before 5.10.273, 5.15.17 to before 5.15.224, 5.16.3 to before 5.17, 5.17.0 to before 6.1.184, 6.2.0 to before 6.6.143, 6.7.0 to before 6.12.95, 6.13.0 to before 6.18.22, and 6.19.0 to before 6.19.12. The bug needs the bonding driver in use with broadcast transmit mode and concurrent slave enslave or release; check the running version with uname -r and whether bonding is loaded with lsmod | grep bonding.Source: git.kernel.org

What should I do about it?

Upgrade to the fixed release for your branch, as listed: 5.10.273, 5.15.224, 5.17, 6.1.184, 6.6.143, 6.12.95, 6.18.22, or 6.19.12.Source: git.kernel.org

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data