CVE-2026-23119

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: provide a net pointer to __skb_flow_dissect()

After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect")

we have to provide a net pointer to __skb_flow_dissect(),

either via skb->dev, skb->sk, or a user provided pointer.

In the following case, syzbot was able to cook a bare skb.

WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0xb57/0x68b0 net/core/flow_dissector.c:1131, CPU#1: syz.2.1418/11053

Call Trace:

<TASK>

bond_flow_dissect drivers/net/bonding/bond_main.c:4093 [inline]

__bond_xmit_hash+0x2d7/0xba0 drivers/net/bonding/bond_main.c:4157

bond_xmit_hash_xdp drivers/net/bonding/bond_main.c:4208 [inline]

bond_xdp_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5139 [inline]

bond_xdp_get_xmit_slave+0x1fd/0x710 drivers/net/bonding/bond_main.c:5515

xdp_master_redirect+0x13f/0x2c0 net/core/filter.c:4388

bpf_prog_run_xdp include/net/xdp.h:700 [inline]

bpf_te

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References