CVE-2026-74726 (GCVE-0-2026-74726)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
Title
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC. Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6667 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < f7668762bf5fd6db9397de5c0514407489d9d815 (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 09add8d5cfa9c46828f51eaad162c36e86366b71 (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < b82f51681a7a88c7d3c865e817a3340d42b5fa2a (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < dd148539fb4741d01c06b7d2c8bd84b01920756c (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < dccec0227ed8d9e36936d66e256b957dc2858468 (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 2faf75a8a06504071b4c0aea7e45a9cc49a4e187 (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2 (git)
Affected: d0e81b7e2246a41d068ecaf15aac9de570816d63 , < 683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.24
Unaffected: 0 , < 2.6.24 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n  Oops: general protection fault, probably for non-canonical address ...\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  Workqueue: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local RTNL netlink (RTM_DELLINK) or bonding ioctl (SIOCBONDRELEASE) to remove/reconfigure slaves while bond_alb_monitor runs; the bug is in a delayed workqueue, not in packet receive or any remote network protocol path.\nAC:L - An attacker with CAP_NET_ADMIN controls both race sides\u2014timing slave removal/failover against the periodic ALB monitor after primary_is_promisc is set\u2014and can retry rapidly when rtnl_trylock fails, making NULL deref or promiscuity-counter underflow reliably winnable.\nPR:L - Triggering ALB bond setup and slave release requires CAP_NET_ADMIN, which unprivileged users can obtain inside a user+network namespace (unshare -Urn), enabling host-wide kernel panic without init-namespace root on typical distributions.\nUI:N - No victim interaction is required; the attacker programmatically creates an ALB bond, drives primary_is_promisc via slave disable/removal, and races bond_alb_monitor without any other user or administrator action.\nS:U - Impact is confined to kernel networking state and causes host kernel panic or netdev promiscuity corruption; it does not cross VM, container, or IOMMU security boundaries into another security authority.\nC:H - Beyond the NULL-deref crash path, the failover race underflows dev-\u003epromiscuity and permanently pins IFF_PROMISC on the new active slave, enabling sustained capture of all traffic on that bonded interface/segment\u2014a broad confidentiality impact on server/cloud HA deployments.\nI:L - The stale dev_set_promiscuity(-1) corrupts the netdev promiscuity counter (unsigned underflow to a huge value), improperly modifying kernel network device state even though it does not provide arbitrary memory write or code-execution primitives.\nA:H - If the active slave is removed without failover, the monitor dereferences a NULL curr_active_slave and panics the kernel, as confirmed by KASAN null-ptr-deref and \"Kernel panic - not syncing: Fatal exception\" in the fix commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:07.173Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
        },
        {
          "url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
        },
        {
          "url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
        },
        {
          "url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
        }
      ],
      "title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74726",
    "datePublished": "2026-08-22T15:33:17.128Z",
    "dateReserved": "2026-08-15T05:44:03.929Z",
    "dateUpdated": "2026-08-25T05:42:07.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74726",
      "date": "2026-10-15",
      "epss": "0.00126",
      "percentile": "0.02035"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T02:14:37.000Z",
      "cve": "CVE-2026-74726",
      "id": "msrc_CVE-2026-74726",
      "initial_release_date": "2026-08-24T01:09:37.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74726.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_alb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
                    "status": "affected",
                    "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/bonding/bond_alb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.24"
                  },
                  {
                    "lessThan": "2.6.24",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n  Oops: general protection fault, probably for non-canonical address ...\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  Workqueue: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbonding: alb: volver a verificar primary_is_promisc bajo RTNL en bond_alb_monitor\n\nbond_alb_monitor() lee primary_is_promisc bajo RCU, luego libera RCU y toma RTNL a trav\u00e9s de rtnl_trylock() antes de deshacer la promiscuidad que estableci\u00f3 en el esclavo activo. En esa ventana, el esclavo activo puede cambiar bajo RTNL (RTM_DELLINK  -\u003e  __bond_release_one()  -\u003e  bond_alb_handle_active_change()), lo que ya libera la promiscuidad y borra primary_is_promisc. El monitor sigue actuando sobre la decisi\u00f3n obsoleta: si el esclavo fue eliminado sin conmutaci\u00f3n por error, curr_active_slave es ahora NULL y la desreferencia falla; si conmut\u00f3 por error, el obsoleto dev_set_promiscuity(-1) provoca un desbordamiento negativo en el contador de promiscuidad del nuevo esclavo y lo fija en IFF_PROMISC.\n\n  Oops: fallo de protecci\u00f3n general, probablemente por una direcci\u00f3n no can\u00f3nica ...\n  KASAN: desreferencia de puntero nulo en el rango [0x0000000000000000-0x0000000000000007]\n  Cola de trabajo: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  P\u00e1nico del kernel - no sincronizando: Excepci\u00f3n fatal\n\nVolver a verificar primary_is_promisc (y curr_active_slave) despu\u00e9s de tomar RTNL para que el monitor solo deshaga un incremento que a\u00fan posee. Los otros monitores de bonding ya releen el estado bajo RTNL en su fase de confirmaci\u00f3n (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() era el \u00fanico que actuaba sobre la decisi\u00f3n previa al trylock."
          }
        ],
        "id": "CVE-2026-74726",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-22T16:16:47.673",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:56:22+00:00",
      "cve": "CVE-2026-74726",
      "id": "CVE-2026-74726",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74726.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.