CVE-2026-23212

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: annotate data-races around slave->last_rx

slave->last_rx and slave->target_last_arp_rx[...] can be read and written

locklessly. Add READ_ONCE() and WRITE_ONCE() annotations.

syzbot reported:

BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:

bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335

bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533

__netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039

__netif_receive_skb_one_core net/core/dev.c:6150 [inline]

__netif_receive_skb+0x59/0x270 net/core/dev.c:6265

netif_receive_skb_internal net/core/dev.c:6351 [inline]

netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410

...

write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:

bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335

bond_handle_frame+0xde/0x5e0 drivers/net/bond

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References