CVE-2026-23171: bonding: fix use-after-free due to enslave fail after slave array update
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdppass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdppass.o sec xdppass ip l add dumdum type dummy
Then run in parallel: while :; do ip l set dumdum master bond1 1/dev/null 2&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"
The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BADPAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdevcorepicktx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] TASK [ 605.603410] devqueuexmit+0x448/0x32a0 [ 605.603434] ? pfxvprintkemit+0x10/0x10 [ 605.603461] ? pfxvprintkemit+0x10/0x10 [ 605.603484] ? pfxdevqueuexmit+0x10/0x10 [ 605.603507] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603546] ? printk+0xcb/0x100 [ 605.603566] ? pfxprintk+0x10/0x10 [ 605.603589] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603627] ? addtaint+0x5e/0x70 [ 605.603648] ? addtaint+0x2a/0x70 [ 605.603670] ? endreport.cold+0x51/0x75 [ 605.603693] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603731] bondstartxmit+0x623/0xc20 [bonding]
Other sources
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdppass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdppass.o sec xdppass ip l add dumdum type dummy
Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"
The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BADPAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdevcorepicktx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] devqueuexmit+0x448/0x32a0 [ 605.603434] ? pfxvprintkemit+0x10/0x10 [ 605.603461] ? pfxvprintkemit+0x10/0x10 [ 605.603484] ? pfxdevqueuexmit+0x10/0x10 [ 605.603507] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603546] ? printk+0xcb/0x100 [ 605.603566] ? pfxprintk+0x10/0x10 [ 605.603589] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603627] ? addtaint+0x5e/0x70 [ 605.603648] ? addtaint+0x2a/0x70 [ 605.603670] ? endreport.cold+0x51/0x75 [ 605.603693] ? bondstartxmit+0xbfb/0xc20 [bonding] [ 605.603731] bondstartxmit+0x623/0xc20 [bonding]
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (bonding)to a version that resolves this vulnerability.Fixed in 6.19.0-rc6+ #21 - Configuration
Apply the bonding fix so that the new slave can be used for Tx only after XDP setup; this prevents the use-after-free caused by enslave failure and the cleanup path freeing allocated slave memory.
bonding Tx slave array update / enslave failure ordering = Move the new slave usage for Tx to after XDP setup to avoid use-after-free after enslave failure
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23171?
CVE-2026-23171 has been rated as a medium severity vulnerability.
How do I fix CVE-2026-23171?
To fix CVE-2026-23171, upgrade to the patched version of the Linux kernel that addresses this vulnerability.
What is the impact of CVE-2026-23171 on system security?
The impact of CVE-2026-23171 can lead to potential system instability or exploitation through a use-after-free condition.
Which Linux kernel versions are affected by CVE-2026-23171?
CVE-2026-23171 affects specific versions of the Linux kernel, particularly those prior to the security patch release.
What components are impacted by CVE-2026-23171?
CVE-2026-23171 impacts the bonding subsystem in the Linux kernel due to issues with slave array management.