{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74726", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:17.128Z", "dateUpdated": "2026-08-22T15:33:17.128Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:17.128Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave's\npromiscuity counter and pins it in IFF_PROMISC.\n\n Oops: general protection fault, probably for non-canonical address ...\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n Workqueue: b42 bond_alb_monitor\n RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n process_one_work (kernel/workqueue.c:3322)\n worker_thread (kernel/workqueue.c:3486)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/bonding/bond_alb.c" ], "versions": [ { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2", "status": "affected", "versionType": "git" }, { "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63", "lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/bonding/bond_alb.c" ], "versions": [ { "version": "2.6.24", "status": "affected" }, { "version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.152" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.104" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.45" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.1.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815" }, { "url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71" }, { "url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a" }, { "url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c" }, { "url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468" }, { "url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187" }, { "url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2" }, { "url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d" } ], "title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor", "x_generator": { "engine": "bippy-1.2.0" } } } }