GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23212 (GCVE-0-2026-23212)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:16 – Updated: 2026-06-11 18:44
VLAI
Title
bonding: annotate data-races around slave->last_rx
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 ... write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb+0x59/0x270 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410 br_netif_receive_skb net/bridge/br_input.c:30 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] ... value changed: 0x0000000100005365 -> 0x0000000100005366
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:42 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f5b2b966f032f22d3a289045a5afd4afa09f09c6 , < a7516cb0165926d308187e231ccd330e5e3ebff7 (git)
Affected: f5b2b966f032f22d3a289045a5afd4afa09f09c6 , < 8c0be3277e7aefb2f900fc37ca3fe7df362e26f5 (git)
Affected: f5b2b966f032f22d3a289045a5afd4afa09f09c6 , < b956289b83887e0a306067b6003c3fcd81bfdf84 (git)
Affected: f5b2b966f032f22d3a289045a5afd4afa09f09c6 , < bd98324e327e41de04b13e372cc16f73150df254 (git)
Affected: f5b2b966f032f22d3a289045a5afd4afa09f09c6 , < f6c3665b6dc53c3ab7d31b585446a953a74340ef (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.123 , ≤ 6.6.* (semver)
Unaffected: 6.12.69 , ≤ 6.12.* (semver)
Unaffected: 6.18.9 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:09.675357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:20.013Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_options.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7516cb0165926d308187e231ccd330e5e3ebff7",
              "status": "affected",
              "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
              "versionType": "git"
            },
            {
              "lessThan": "8c0be3277e7aefb2f900fc37ca3fe7df362e26f5",
              "status": "affected",
              "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
              "versionType": "git"
            },
            {
              "lessThan": "b956289b83887e0a306067b6003c3fcd81bfdf84",
              "status": "affected",
              "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
              "versionType": "git"
            },
            {
              "lessThan": "bd98324e327e41de04b13e372cc16f73150df254",
              "status": "affected",
              "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
              "versionType": "git"
            },
            {
              "lessThan": "f6c3665b6dc53c3ab7d31b585446a953a74340ef",
              "status": "affected",
              "version": "f5b2b966f032f22d3a289045a5afd4afa09f09c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "drivers/net/bonding/bond_options.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.123",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.69",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.123",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.69",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: annotate data-races around slave-\u003elast_rx\n\nslave-\u003elast_rx and slave-\u003etarget_last_arp_rx[...] can be read and written\nlocklessly. Add READ_ONCE() and WRITE_ONCE() annotations.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n...\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n...\n\nvalue changed: 0x0000000100005365 -\u003e 0x0000000100005366"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:29.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7516cb0165926d308187e231ccd330e5e3ebff7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c0be3277e7aefb2f900fc37ca3fe7df362e26f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b956289b83887e0a306067b6003c3fcd81bfdf84"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd98324e327e41de04b13e372cc16f73150df254"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6c3665b6dc53c3ab7d31b585446a953a74340ef"
        }
      ],
      "title": "bonding: annotate data-races around slave-\u003elast_rx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23212",
    "datePublished": "2026-02-18T14:16:28.104Z",
    "dateReserved": "2026-01-13T15:37:45.986Z",
    "dateUpdated": "2026-06-11T18:44:20.013Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23212",
      "date": "2026-09-17",
      "epss": "0.00089",
      "percentile": "0.00481"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23212\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-18T15:18:42.470\",\"lastModified\":\"2026-06-17T10:21:06.667\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: annotate data-races around slave-\u003elast_rx\\n\\nslave-\u003elast_rx and slave-\u003etarget_last_arp_rx[...] can be read and written\\nlocklessly. Add READ_ONCE() and WRITE_ONCE() annotations.\\n\\nsyzbot reported:\\n\\nBUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate\\n\\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n...\\n\\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\\n  NF_HOOK include/linux/netfilter.h:318 [inline]\\n...\\n\\nvalue changed: 0x0000000100005365 -\u003e 0x0000000100005366\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nbonding: anotar condiciones de carrera de datos alrededor de slave-\u0026gt;last_rx\\n\\nslave-\u0026gt;last_rx y slave-\u0026gt;target_last_arp_rx[...] pueden ser le\u00eddos y escritos sin bloqueo. A\u00f1adir anotaciones READ_ONCE() y WRITE_ONCE().\\n\\nsyzbot inform\u00f3:\\n\\nERROR: KCSAN: condici\u00f3n de carrera de datos en bond_rcv_validate / bond_rcv_validate\\n\\nescritura en 0xffff888149f0d428 de 8 bytes por interrupci\u00f3n en la CPU 1:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n...\\n\\nescritura en 0xffff888149f0d428 de 8 bytes por interrupci\u00f3n en la CPU 0:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\\n  NF_HOOK include/linux/netfilter.h:318 [inline]\\n...\\n\\nvalor cambiado: 0x0000000100005365 -\u0026gt; 0x0000000100005366\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\",\"drivers/net/bonding/bond_options.c\",\"include/net/bonding.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f5b2b966f032f22d3a289045a5afd4afa09f09c6\",\"lessThan\":\"a7516cb0165926d308187e231ccd330e5e3ebff7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5b2b966f032f22d3a289045a5afd4afa09f09c6\",\"lessThan\":\"8c0be3277e7aefb2f900fc37ca3fe7df362e26f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5b2b966f032f22d3a289045a5afd4afa09f09c6\",\"lessThan\":\"b956289b83887e0a306067b6003c3fcd81bfdf84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5b2b966f032f22d3a289045a5afd4afa09f09c6\",\"lessThan\":\"bd98324e327e41de04b13e372cc16f73150df254\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f5b2b966f032f22d3a289045a5afd4afa09f09c6\",\"lessThan\":\"f6c3665b6dc53c3ab7d31b585446a953a74340ef\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\",\"drivers/net/bonding/bond_options.c\",\"include/net/bonding.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.123\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.69\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.9\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:42:09.675357Z\",\"id\":\"CVE-2026-23212\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.19\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"C7C23F7A-B2D7-4094-9419-D02BB6EEF2A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.123\",\"matchCriteriaId\":\"316D8D4E-FE44-4C76-8403-63CAF51EEFC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.69\",\"matchCriteriaId\":\"3F0D11B0-A3DA-4D8F-89B9-CFD2094EBA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.9\",\"matchCriteriaId\":\"171CFCB2-8F49-4F9E-8A67-FAC6BF45B5A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8c0be3277e7aefb2f900fc37ca3fe7df362e26f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7516cb0165926d308187e231ccd330e5e3ebff7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b956289b83887e0a306067b6003c3fcd81bfdf84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd98324e327e41de04b13e372cc16f73150df254\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6c3665b6dc53c3ab7d31b585446a953a74340ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T12:05:13+00:00",
      "cve": "CVE-2026-23212",
      "id": "CVE-2026-23212",
      "initial_release_date": "2026-02-18T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bonding: annotate data-races around slave-\u003elast_rx",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23212.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23212\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:42:09.675357Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:39:07.107Z\"}}], \"cna\": {\"title\": \"bonding: annotate data-races around slave-\u003elast_rx\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f5b2b966f032f22d3a289045a5afd4afa09f09c6\", \"lessThan\": \"a7516cb0165926d308187e231ccd330e5e3ebff7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5b2b966f032f22d3a289045a5afd4afa09f09c6\", \"lessThan\": \"8c0be3277e7aefb2f900fc37ca3fe7df362e26f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5b2b966f032f22d3a289045a5afd4afa09f09c6\", \"lessThan\": \"b956289b83887e0a306067b6003c3fcd81bfdf84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5b2b966f032f22d3a289045a5afd4afa09f09c6\", \"lessThan\": \"bd98324e327e41de04b13e372cc16f73150df254\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f5b2b966f032f22d3a289045a5afd4afa09f09c6\", \"lessThan\": \"f6c3665b6dc53c3ab7d31b585446a953a74340ef\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\", \"drivers/net/bonding/bond_options.c\", \"include/net/bonding.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.123\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.69\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\", \"drivers/net/bonding/bond_options.c\", \"include/net/bonding.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a7516cb0165926d308187e231ccd330e5e3ebff7\"}, {\"url\": \"https://git.kernel.org/stable/c/8c0be3277e7aefb2f900fc37ca3fe7df362e26f5\"}, {\"url\": \"https://git.kernel.org/stable/c/b956289b83887e0a306067b6003c3fcd81bfdf84\"}, {\"url\": \"https://git.kernel.org/stable/c/bd98324e327e41de04b13e372cc16f73150df254\"}, {\"url\": \"https://git.kernel.org/stable/c/f6c3665b6dc53c3ab7d31b585446a953a74340ef\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: annotate data-races around slave-\u003elast_rx\\n\\nslave-\u003elast_rx and slave-\u003etarget_last_arp_rx[...] can be read and written\\nlocklessly. Add READ_ONCE() and WRITE_ONCE() annotations.\\n\\nsyzbot reported:\\n\\nBUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate\\n\\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n...\\n\\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:\\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\\n  NF_HOOK include/linux/netfilter.h:318 [inline]\\n...\\n\\nvalue changed: 0x0000000100005365 -\u003e 0x0000000100005366\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.123\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.69\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.9\", \"versionStartIncluding\": \"2.6.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"2.6.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T22:02:29.466Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23212\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:20.013Z\", \"dateReserved\": \"2026-01-13T15:37:45.986Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-18T14:16:28.104Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.