FKIE_CVE-2026-74726

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-10-14 13:10
Severity
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the active slave. In that window the active slave can change under RTNL (RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()), which already drops the promiscuity and clears primary_is_promisc. The monitor still acts on the stale decision: if the slave was removed with no failover, curr_active_slave is now NULL and the deref faults; if it failed over, the stale dev_set_promiscuity(-1) underflows the new slave's promiscuity counter and pins it in IFF_PROMISC. Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: b42 bond_alb_monitor RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Kernel panic - not syncing: Fatal exception Re-check primary_is_promisc (and curr_active_slave) after taking RTNL so the monitor only undoes an increment it still owns. The other bonding monitors already re-read state under RTNL in their commit phase (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only one acting on the pre-trylock decision.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n  Oops: general protection fault, probably for non-canonical address ...\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  Workqueue: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbonding: alb: volver a verificar primary_is_promisc bajo RTNL en bond_alb_monitor\n\nbond_alb_monitor() lee primary_is_promisc bajo RCU, luego libera RCU y toma RTNL a trav\u00e9s de rtnl_trylock() antes de deshacer la promiscuidad que estableci\u00f3 en el esclavo activo. En esa ventana, el esclavo activo puede cambiar bajo RTNL (RTM_DELLINK  -\u003e  __bond_release_one()  -\u003e  bond_alb_handle_active_change()), lo que ya libera la promiscuidad y borra primary_is_promisc. El monitor sigue actuando sobre la decisi\u00f3n obsoleta: si el esclavo fue eliminado sin conmutaci\u00f3n por error, curr_active_slave es ahora NULL y la desreferencia falla; si conmut\u00f3 por error, el obsoleto dev_set_promiscuity(-1) provoca un desbordamiento negativo en el contador de promiscuidad del nuevo esclavo y lo fija en IFF_PROMISC.\n\n  Oops: fallo de protecci\u00f3n general, probablemente por una direcci\u00f3n no can\u00f3nica ...\n  KASAN: desreferencia de puntero nulo en el rango [0x0000000000000000-0x0000000000000007]\n  Cola de trabajo: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  P\u00e1nico del kernel - no sincronizando: Excepci\u00f3n fatal\n\nVolver a verificar primary_is_promisc (y curr_active_slave) despu\u00e9s de tomar RTNL para que el monitor solo deshaga un incremento que a\u00fan posee. Los otros monitores de bonding ya releen el estado bajo RTNL en su fase de confirmaci\u00f3n (bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() era el \u00fanico que actuaba sobre la decisi\u00f3n previa al trylock."
    }
  ],
  "id": "CVE-2026-74726",
  "lastModified": "2026-10-14T13:10:00.187",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.5,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:47.673",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.