CVE-2026-52975

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: 3ad: implement proper RCU rules for port->aggregator

syzbot found a data-race in bond_3ad_get_active_agg_info /

bond_3ad_state_machine_handler [1] which hints at lack of proper

RCU implementation.

Add __rcu qualifier to port->aggregator, and add proper RCU API.

[1]

BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler

write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:

ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]

bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569

process_one_work kernel/workqueue.c:3302 [inline]

process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385

worker_thread+0x58a/0x780 kernel/workqueue.c:3466

kthread+0x22a/0x280 kernel/kthread.c:436

ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158

ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff88813cf5c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References