CVE-2026-45970
published 2026-05-27CVE-2026-45970: In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
The ALB RX path may access rx_hashtbl concurrently with bond
teardown. During rapid bond up/down cycles, rlb_deinitialize()
frees rx_hashtbl while RX handlers are still running, leading
to a null pointer dereference detected by KASAN.
However, the root cause is that rlb_arp_recv() can still be accessed
after setting recv_probe to NULL, which is actually a use-after-free
(UAF) issue. That is the reason for using the referenced commit in the
Fixes tag.
[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI
[ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
[ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary)
[ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022
[ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding]
[ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 b6
04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00
[ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206
[ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e
[ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8
[ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8
[ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119
[ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810
[ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000
[ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0
[ 214.310347] Call Trace:
[ 214.313070]
[ 214.31531
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c | fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < de7c097800f07f3c108185c7a38b53a530ba30ff | de7c097800f07f3c108185c7a38b53a530ba30ff |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < db5435b5342e3aaa4521d0f3ccfe94316b253ca1 | db5435b5342e3aaa4521d0f3ccfe94316b253ca1 |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < f94a0de7b9f32745a14a1621c63087a092823587 | f94a0de7b9f32745a14a1621c63087a092823587 |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < c65cdf46ce340c9c00fbbaf84599d2daff43626e | c65cdf46ce340c9c00fbbaf84599d2daff43626e |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < fef13c403be3fb685cb06419e6b3623106aab5ba | fef13c403be3fb685cb06419e6b3623106aab5ba |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < d31065526f160ee0244a719230aa069daca2bf4d | d31065526f160ee0244a719230aa069daca2bf4d |
| linux | linux | >= 3aba891dde3842d89ad022237b99c1ed308040b0 < e6834a4c474697df23ab9948fd3577b26bf48656 | e6834a4c474697df23ab9948fd3577b26bf48656 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.0 < 5.10.252 | 5.10.252 |
| linux | linux_kernel | >= 5.11 < 5.15.202 | 5.15.202 |
| linux | linux_kernel | >= 5.16 < 6.1.165 | 6.1.165 |
| linux | linux_kernel | >= 6.13 < 6.18.14 | 6.18.14 |
| linux | linux_kernel | >= 6.19 < 6.19.4 | 6.19.4 |
| linux | linux_kernel | >= 6.2 < 6.6.128 | 6.6.128 |
| linux | linux_kernel | >= 6.7 < 6.12.75 | 6.12.75 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-5.15 | — | — |
| ubuntu | linux-aws-6.8 | — | — |
| ubuntu | linux-aws-fips | — | — |
| ubuntu | linux-azure-fips | — | — |
| ubuntu | linux-fips | — | — |
| ubuntu | linux-gcp | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.1
CVE-2026-46187 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 7.1
CVE-2024-36898 [HIGH] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation
Ubuntu
Linux kernel (FIPS) vulnerabilities
vendor_ubuntu·2026-07-10
CVE-2025-71235 Linux kernel (FIPS) vulnerabilities
Title: Linux kernel (FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monito
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-45960 Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel (Raspberry Pi Real-time) vulnerabilities
vendor_ubuntu·2026-07-06
CVE-2026-43314 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Title: Linux kernel (Raspberry Pi Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 8.8
CVE-2026-43314 [HIGH] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a conta
Ubuntu
Linux kernel (Xilinx) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 7.8
CVE-2026-43314 [HIGH] Linux kernel (Xilinx) vulnerabilities
Title: Linux kernel (Xilinx) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container. (CVE-2026-31431)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01
CVE-2026-43226 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Red Hat
kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down
vendor_redhat·2026-05-27·CVSS 7.0
CVE-2026-45970 [MEDIUM] CWE-364 kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down
kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down
A flaw was found in the Linux kernel's bonding driver, specifically within the Active-Backup Load Balancing (ALB) receive path. A local attacker can trigger a Use-After-Free (UAF) vulnerability in the rlb_arp_recv function by rapidly bringing a bond interface up and down while receiving Address Resolution Protocol (ARP) messages. This concurrent access to freed memory can lead to a null pointer dereference, resulting in a system crash and a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (R
VulDB
Linux Kernel up to 6.19.3 rlb_deinitialize use after free (Nessus ID 321065)
vuldb·2026-06-14·CVSS 7.8
CVE-2026-45970 [HIGH] Linux Kernel up to 6.19.3 rlb_deinitialize use after free (Nessus ID 321065)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.19.3. Affected by this issue is the function rlb_deinitialize. The manipulation results in use after free.
This vulnerability is known as CVE-2026-45970. Access to the local network is required for this attack. No exploit is available.
The affected component should be upgraded.
GHSA
GHSA-mc9g-h8jv-5cp3: In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
The ALB RX path may ac
ghsa_unreviewed·2026-05-27
CVE-2026-45970 GHSA-mc9g-h8jv-5cp3: In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
The ALB RX path may ac
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
The ALB RX path may access rx_hashtbl concurrently with bond
teardown. During rapid bond up/down cycles, rlb_deinitialize()
frees rx_hashtbl while RX handlers are still running, leading
to a null pointer dereference detected by KASAN.
However, the root cause is that rlb_arp_recv() can still be accessed
after setting recv_probe to NULL, which is actually a use-after-free
(UAF) issue. That is the reason for using the referenced commit in the
Fixes tag.
[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI
[ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
[ 214
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626ehttps://git.kernel.org/stable/c/d31065526f160ee0244a719230aa069daca2bf4dhttps://git.kernel.org/stable/c/db5435b5342e3aaa4521d0f3ccfe94316b253ca1https://git.kernel.org/stable/c/de7c097800f07f3c108185c7a38b53a530ba30ffhttps://git.kernel.org/stable/c/e6834a4c474697df23ab9948fd3577b26bf48656https://git.kernel.org/stable/c/f94a0de7b9f32745a14a1621c63087a092823587https://git.kernel.org/stable/c/fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803chttps://git.kernel.org/stable/c/fef13c403be3fb685cb06419e6b3623106aab5ba
2026-05-27
Published