CVE-2026-23171

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix use-after-free due to enslave fail after slave array update

Fix a use-after-free which happens due to enslave failure after the new

slave has been added to the array. Since the new slave can be used for Tx

immediately, we can use it after it has been freed by the enslave error

cleanup path which frees the allocated slave memory. Slave update array is

supposed to be called last when further enslave failures are not expected.

Move it after xdp setup to avoid any problems.

It is very easy to reproduce the problem with a simple xdp_pass prog:

ip l add bond1 type bond mode balance-xor

ip l set bond1 up

ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass

ip l add dumdum type dummy

Then run in parallel:

while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done;

mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"

The crash happens almost immediately:

[ 605.6028

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References