CVE-2026-31419

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix use-after-free in bond_xmit_broadcast()

bond_xmit_broadcast() reuses the original skb for the last slave

(determined by bond_is_last_slave()) and clones it for others.

Concurrent slave enslave/release can mutate the slave list during

RCU-protected iteration, changing which slave is "last" mid-loop.

This causes the original skb to be double-consumed (double-freed).

Replace the racy bond_is_last_slave() check with a simple index

comparison (i + 1 == slaves_count) against the pre-snapshot slave

count taken via READ_ONCE() before the loop. This preserves the

zero-copy optimization for the last slave while making the "last"

determination stable against concurrent list mutations.

The UAF can trigger the following crash:

==================================================================

BUG: KASAN: slab-use-after-free in skb_clone

Read of size 8 at addr ffff888100ef8d40 by task exploit/147

CPU: 1 UID:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References