CVE-2026-74726

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor

bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and

takes RTNL via rtnl_trylock() before undoing the promiscuity it set on the

active slave. In that window the active slave can change under RTNL

(RTM_DELLINK -> __bond_release_one() -> bond_alb_handle_active_change()),

which already drops the promiscuity and clears primary_is_promisc. The

monitor still acts on the stale decision: if the slave was removed with no

failover, curr_active_slave is now NULL and the deref faults; if it failed

over, the stale dev_set_promiscuity(-1) underflows the new slave's

promiscuity counter and pins it in IFF_PROMISC.

Oops: general protection fault, probably for non-canonical address ...

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

Workqueue: b42 bond_alb_monitor

RIP: 0010:bond_alb_monitor (drivers/net/bonding

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References