Linux Kernel Vulnerability in Bonding Driver Affecting Multiple Distributions

CVE-2026-74726

What is CVE-2026-74726?

The bonding driver in the Linux kernel has a flaw when checking the primary promiscuity under RTNL in the bond_alb_monitor function. This issue arises when the monitor reads the primary_is_promisc state under RCU, subsequently drops RCU, and locks RTNL without reassessing the current state of the active slave. If the active slave changes during this window without a failover, it can lead to dereferencing a null pointer, resulting in a kernel panic. Correcting the logic to reevaluate the state under RTNL is necessary to prevent this potential crash and improve system stability.

References