CVE-2026-23171
published 2026-02-14CVE-2026-23171: In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new
slave has been added to the array. Since the new slave can be used for Tx
immediately, we can use it after it has been freed by the enslave error
cleanup path which frees the allocated slave memory. Slave update array is
supposed to be called last when further enslave failures are not expected.
Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l set bond1 up
ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass
ip l add dumdum type dummy
Then run in parallel:
while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done;
mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"
The crash happens almost immediately:
[ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI
[ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf]
[ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary)
[ 605.602979] Tainted: [B]=BAD_PAGE
[ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210
[ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89
[ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213
[ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000
[ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be
[ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.9-1 (forky) | linux 6.18.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < 172dcb67dd35b162357df229d7806acc724cd469 | 172dcb67dd35b162357df229d7806acc724cd469 |
| linux | linux | >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < 2889d92c5f728351c9930c7996d22fe6e906e785 | 2889d92c5f728351c9930c7996d22fe6e906e785 |
| linux | linux | >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d | bd25b092a06a3e05f7e8bd6da6fa7318777d8c3d |
| linux | linux | >= 9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e < e9acda52fd2ee0cdca332f996da7a95c5fd25294 | e9acda52fd2ee0cdca332f996da7a95c5fd25294 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.9-1 | 6.18.9-1 |
| linux | linux_kernel | >= 5.15 < 6.18.9 | 6.18.9 |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_msrc6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
vendor_redhat·2026-02-14·CVSS 7.8
CVE-2026-23171 [HIGH] CWE-416 kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new
slave has been added to the array. Since the new slave can be used for Tx
immediately, we can use it after it has been freed by the enslave error
cleanup path which frees the allocated slave memory. Slave update array is
supposed to be called last when further enslave failures are not expected.
Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l set bond1 up
ip l se
Microsoft
bonding: fix use-after-free due to enslave fail after slave array update
vendor_msrc·2026-02-10·CVSS 6.7
CVE-2026-23171 [HIGH] bonding: fix use-after-free due to enslave fail after slave array update
bonding: fix use-after-free due to enslave fail after slave array update
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2026-23171: linux - In the Linux kernel, the following vulnerability has been resolved: bonding: fi...
vendor_debian·2026·CVSS 7.8
CVE-2026-23171 [HIGH] CVE-2026-23171: linux - In the Linux kernel, the following vulnerability has been resolved: bonding: fi...
In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do
VulDB
Linux Kernel up to 6.18.8 xdp_pass use after free (Nessus ID 299066 / WID-SEC-2026-0421)
vuldb·2026-04-13·CVSS 7.8
CVE-2026-23171 [HIGH] Linux Kernel up to 6.18.8 xdp_pass use after free (Nessus ID 299066 / WID-SEC-2026-0421)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.18.8. This affects the function xdp_pass. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-23171. Access to the local network is required for this attack. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-5r72-p4cv-h344: In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a u
ghsa_unreviewed·2026-02-14
CVE-2026-23171 [HIGH] CWE-416 GHSA-5r72-p4cv-h344: In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a u
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new
slave has been added to the array. Since the new slave can be used for Tx
immediately, we can use it after it has been freed by the enslave error
cleanup path which frees the allocated slave memory. Slave update array is
supposed to be called last when further enslave failures are not expected.
Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l set bond1 up
ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass
ip l add dumdum type dummy
Then run in parallel:
while :
OSV
CVE-2026-23171: In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use
osv·2026-02-14·CVSS 7.8
CVE-2026-23171 [HIGH] CVE-2026-23171: In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use
In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23171 kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
bugzilla·2026-02-14·CVSS 7.8
CVE-2026-23171 [HIGH] CVE-2026-23171 kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
CVE-2026-23171 kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new
slave has been added to the array. Since the new slave can be used for Tx
immediately, we can use it after it has been freed by the enslave error
cleanup path which frees the allocated slave memory. Slave update array is
supposed to be called last when further enslave failures are not expected.
Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l se
Wiz
CVE-2026-23171 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-23171 [HIGH] CVE-2026-23171 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23171 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix use-after-free due to enslave fail after slave array update
Fix a use-after-free which happens due to enslave failure after the new
slave has been added to the array. Since the new slave can be used for Tx
immediately, we can use it after it has been freed by the enslave error
cleanup path which frees the allocated slave memory. Slave update array is
supposed to be called last when further enslave failures are not expected.
Move it after xdp setup to avoid any problems.
It is very easy to reproduce the problem with a simple xdp_pass prog:
ip l add bond1 type bond mode balance-xor
ip l set bond1 up
ip l set dev bond1 xdp object xdp_pass
2026-02-14
Published