CVE-2026-23310

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded

bond_option_mode_set() already rejects mode changes that would make a

loaded XDP program incompatible via bond_xdp_check(). However,

bond_option_xmit_hash_policy_set() has no such guard.

For 802.3ad and balance-xor modes, bond_xdp_check() returns false when

xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually

absent due to hardware offload. This means a user can:

1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode

with a compatible xmit_hash_policy (e.g. layer2+3).

2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.

This leaves bond->xdp_prog set but bond_xdp_check() now returning false

for the same device. When the bond is later destroyed, dev_xdp_uninstall()

calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hits

the bond_xdp_check() guard and returns -EOPNOTSUPP, trig

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References