CVE-2026-74726 (GCVE-0-2026-74726)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-08-25 05:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and
takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the
active slave. In that window the active slave can change under RTNL
(RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),
which already drops the promiscuity and clears primary_is_promisc. The
monitor still acts on the stale decision: if the slave was removed with no
failover, curr_active_slave is now NULL and the deref faults; if it failed
over, the stale dev_set_promiscuity(-1) underflows the new slave's
promiscuity counter and pins it in IFF_PROMISC.
Oops: general protection fault, probably for non-canonical address ...
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: b42 bond_alb_monitor
RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
Kernel panic - not syncing: Fatal exception
Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so
the monitor only undoes an increment it still owns. The other bonding
monitors already re-read state under RTNL in their commit phase
(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only
one acting on the pre-trylock decision.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 Version: d0e81b7e2246a41d068ecaf15aac9de570816d63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_alb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
},
{
"lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
"status": "affected",
"version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_alb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n Workqueue: b42 bond_alb_monitor\n RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local RTNL netlink (RTM_DELLINK) or bonding ioctl (SIOCBONDRELEASE) to remove/reconfigure slaves while bond_alb_monitor runs; the bug is in a delayed workqueue, not in packet receive or any remote network protocol path.\nAC:L - An attacker with CAP_NET_ADMIN controls both race sides\u2014timing slave removal/failover against the periodic ALB monitor after primary_is_promisc is set\u2014and can retry rapidly when rtnl_trylock fails, making NULL deref or promiscuity-counter underflow reliably winnable.\nPR:L - Triggering ALB bond setup and slave release requires CAP_NET_ADMIN, which unprivileged users can obtain inside a user+network namespace (unshare -Urn), enabling host-wide kernel panic without init-namespace root on typical distributions.\nUI:N - No victim interaction is required; the attacker programmatically creates an ALB bond, drives primary_is_promisc via slave disable/removal, and races bond_alb_monitor without any other user or administrator action.\nS:U - Impact is confined to kernel networking state and causes host kernel panic or netdev promiscuity corruption; it does not cross VM, container, or IOMMU security boundaries into another security authority.\nC:H - Beyond the NULL-deref crash path, the failover race underflows dev-\u003epromiscuity and permanently pins IFF_PROMISC on the new active slave, enabling sustained capture of all traffic on that bonded interface/segment\u2014a broad confidentiality impact on server/cloud HA deployments.\nI:L - The stale dev_set_promiscuity(-1) corrupts the netdev promiscuity counter (unsigned underflow to a huge value), improperly modifying kernel network device state even though it does not provide arbitrary memory write or code-execution primitives.\nA:H - If the active slave is removed without failover, the monitor dereferences a NULL curr_active_slave and panics the kernel, as confirmed by KASAN null-ptr-deref and \"Kernel panic - not syncing: Fatal exception\" in the fix commit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:07.173Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
},
{
"url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
},
{
"url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
},
{
"url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
},
{
"url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
},
{
"url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
},
{
"url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
},
{
"url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
}
],
"title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74726",
"datePublished": "2026-08-22T15:33:17.128Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-08-25T05:42:07.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…