CVE-2026-45970

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: fix UAF in rlb_arp_recv during bond up/down

The ALB RX path may access rx_hashtbl concurrently with bond

teardown. During rapid bond up/down cycles, rlb_deinitialize()

frees rx_hashtbl while RX handlers are still running, leading

to a null pointer dereference detected by KASAN.

However, the root cause is that rlb_arp_recv() can still be accessed

after setting recv_probe to NULL, which is actually a use-after-free

(UAF) issue. That is the reason for using the referenced commit in the

Fixes tag.

[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI

[ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]

[ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary)

[ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022

[ 214

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References