CVE-2026-23451 (GCVE-0-2026-23451)
Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-10-30 12:24
VLAI
EPSS
VEX
Title
bonding: prevent potential infinite loop in bond_header_parse()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: prevent potential infinite loop in bond_header_parse()
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
Severity
7.5 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8 , < 9532d0d0ad1d726c06f807e8f0f1ec93cbabb452
(git)
Affected: 9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d , < 946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c (git) Affected: 6ac890f1d60ac3707ee8dae15a67d9a833e49956 , < 4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13 (git) Affected: 95597d11dc8bddb2b9a051c9232000bfbb5e43ba , < 9b49c854f14f5e2d493e562a1e28d2e57fe37371 (git) Affected: 950803f7254721c1c15858fbbfae3deaaeeecb11 , < b7405dcf7385445e10821777143f18c3ce20fa04 (git) Affected: b1f22a658a7b20bcb7d34d40cb2ef3e52847e2fb (git) Affected: 6.1.191 , < 6.2 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.18.19 , < 6.18.20
(semver)
Affected: 6.19.9 , < 6.19.10 (semver) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9532d0d0ad1d726c06f807e8f0f1ec93cbabb452",
"status": "affected",
"version": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"versionType": "git"
},
{
"lessThan": "946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c",
"status": "affected",
"version": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"versionType": "git"
},
{
"lessThan": "4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13",
"status": "affected",
"version": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"versionType": "git"
},
{
"lessThan": "9b49c854f14f5e2d493e562a1e28d2e57fe37371",
"status": "affected",
"version": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"versionType": "git"
},
{
"lessThan": "b7405dcf7385445e10821777143f18c3ce20fa04",
"status": "affected",
"version": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"versionType": "git"
},
{
"status": "affected",
"version": "b1f22a658a7b20bcb7d34d40cb2ef3e52847e2fb",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.191",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.10",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.19.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.191",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: prevent potential infinite loop in bond_header_parse()\n\nbond_header_parse() can loop if a stack of two bonding devices is setup,\nbecause skb-\u003edev always points to the hierarchy top.\n\nAdd new \"const struct net_device *dev\" parameter to\n(struct header_ops)-\u003eparse() method to make sure the recursion\nis bounded, and that the final leaf parse method is called."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable affected deployment, a remote peer can send a packet, including GRE traffic, that arrives through a stacked bonding hierarchy and triggers AF_PACKET/NFLOG/NFQUEUE hardware-address parsing on the top bond. The vulnerable code is reached from network packet receive processing, not from a physical or purely local-only interface.\nAC:L - Once the stacked bond and packet metadata consumer exist, a single matching received packet deterministically enters `dev_parse_header()` and recurses indefinitely. There is no race, timing window, heap shaping, or attacker-uncontrolled probabilistic condition needed to trigger the denial of service.\nPR:N - The network-triggered path does not require the remote attacker to authenticate or hold local privileges; they only need to send traffic to the affected interface/tunnel. Although local namespace users can also create a reproducer with CAP_NET_ADMIN/CAP_NET_RAW in their namespace, the highest reasonable scenario requires no attacker privileges.\nUI:N - No victim action is required at exploit time when the affected bond stack and packet logging/capture path are already active. The packet alone triggers the vulnerable parse path.\nS:U - The impact remains within the kernel/networking security authority of the vulnerable system. There is no VM escape, sandbox boundary crossing, or separate security scope affected.\nC:N - The bug is an unbounded recursive call caused by using the top-level `skb-\u003edev`; it does not create an information disclosure or controlled read primitive.\nI:N - The vulnerable path does not corrupt attacker-selected data or provide a write/control-flow primitive; the final lower-device parser is never reached. The observed consequence is recursion leading to denial of service.\nA:H - The infinite recursion can hang kernel packet processing and lead to stack overflow/lockdep exhaustion or kernel crash. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:24:07.666Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452"
},
{
"url": "https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c"
},
{
"url": "https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13"
},
{
"url": "https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371"
},
{
"url": "https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04"
}
],
"title": "bonding: prevent potential infinite loop in bond_header_parse()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23451",
"datePublished": "2026-04-03T15:15:33.776Z",
"dateReserved": "2026-01-13T15:37:46.020Z",
"dateUpdated": "2026-10-30T12:24:07.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-23451",
"date": "2026-11-07",
"epss": "0.00458",
"percentile": "0.39914"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9532d0d0ad1d726c06f807e8f0f1ec93cbabb452",
"status": "affected",
"version": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"versionType": "git"
},
{
"lessThan": "946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c",
"status": "affected",
"version": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"versionType": "git"
},
{
"lessThan": "4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13",
"status": "affected",
"version": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"versionType": "git"
},
{
"lessThan": "9b49c854f14f5e2d493e562a1e28d2e57fe37371",
"status": "affected",
"version": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"versionType": "git"
},
{
"lessThan": "b7405dcf7385445e10821777143f18c3ce20fa04",
"status": "affected",
"version": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"versionType": "git"
},
{
"status": "affected",
"version": "b1f22a658a7b20bcb7d34d40cb2ef3e52847e2fb",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.191",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.10",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.12.78:*:*:*:*:*:*:*",
"matchCriteriaId": "493FF782-C903-4656-94E0-20B2D0EA024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18.19:*:*:*:*:*:*:*",
"matchCriteriaId": "6D24CF0E-E6F3-40B8-97C7-4913453B199F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19.9:*:*:*:*:*:*:*",
"matchCriteriaId": "AB047D77-F8E9-431C-8103-B177734E5125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: prevent potential infinite loop in bond_header_parse()\n\nbond_header_parse() can loop if a stack of two bonding devices is setup,\nbecause skb-\u003edev always points to the hierarchy top.\n\nAdd new \"const struct net_device *dev\" parameter to\n(struct header_ops)-\u003eparse() method to make sure the recursion\nis bounded, and that the final leaf parse method is called."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbonding: prevenir un potencial bucle infinito en bond_header_parse()\n\nbond_header_parse() puede entrar en bucle si se configura una pila de dos dispositivos bonding, porque skb -\u003e dev siempre apunta a la cima de la jerarqu\u00eda.\n\nA\u00f1adir un nuevo par\u00e1metro \u0027const struct net_device dev\u0027 al m\u00e9todo (struct header_ops) -\u003e parse() para asegurar que la recursi\u00f3n est\u00e9 acotada y que se llame al m\u00e9todo de an\u00e1lisis de hoja final."
}
],
"id": "CVE-2026-23451",
"lastModified": "2026-10-30T13:18:38.593",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-04-03T16:16:31.460",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-835"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-07T04:28:25+00:00",
"cve": "CVE-2026-23451",
"id": "CVE-2026-23451",
"initial_release_date": "2026-04-03T00:00:00+00:00",
"product_status:known_affected": "14",
"product_status:known_not_affected": "186",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bonding: prevent potential infinite loop in bond_header_parse()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23451.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.