CVE-2026-31546

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix NULL deref in bond_debug_rlb_hash_show

rlb_clear_slave intentionally keeps RLB hash-table entries on

the rx_hashtbl_used_head list with slave set to NULL when no

replacement slave is available. However, bond_debug_rlb_hash_show

visites client_info->slave without checking if it's NULL.

Other used-list iterators in bond_alb.c already handle this NULL-slave

state safely:

- rlb_update_client returns early on !client_info->slave

- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance

compare slave values before visiting

- lb_req_update_subnet_clients continues if slave is NULL

The following NULL deref crash can be trigger in

bond_debug_rlb_hash_show:

[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000

[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)

[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286

[ 1.293333]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References